Hack the Route Start free Open app Containers and cloud networking
SD-WAN
A WAN built as encrypted tunnels over several links at once, run from one controller that steers each application onto the best path.
Each site has an SD-WAN edge with several transports underneath (an MPLS line, broadband, LTE or 5G) and builds encrypted tunnels, usually IPsec, over all of them to the other sites and the data center: an overlay on whatever links are there. A central controller (or orchestrator) holds the policy and pushes tunnels, keys and path rules to every edge, as in SDN; a new branch's box ships blank, calls home and configures itself (zero-touch provisioning). The data still flows edge to edge, not through the controller.
Edges probe every path all the time for latency, jitter and loss, and application-aware routing places each application by policy: voice on the path with the least jitter, backups on cheap broadband, and SaaS traffic straight out to the internet from the branch (local breakout) instead of hauled back to headquarters. When a link degrades, flows move to another at once, without waiting for a routing protocol to reconverge. MPLS stays one transport among several rather than the whole WAN.