SD-WAN & SASE
SD-WAN steers traffic across several internet and private circuits by application and link quality, so a branch can use broadband, 5G and MPLS together and move off a failing link. SASE (Secure Access Service Edge) adds cloud-delivered security to that: secure web gateway, zero-trust network access and cloud access security broker policy applied close to the user.
What we do
- Branch SD-WAN on existing firewall or router platforms
- Application-aware routing and link-quality steering
- Broadband, 5G and private-circuit failover
- Zero-touch provisioning for new sites
- Cloud on-ramps to Amazon Web Services (AWS), Google Cloud and Microsoft Azure
- SASE policy: secure web gateway, zero-trust access, CASB
- Underlay and application monitoring
- Migration plans off MPLS-only designs
Our team designs branch and multi-site networks on both sides of this: SD-WAN on the firewalls and routers a business already owns, and SASE services for remote staff and SaaS. We choose the design by site count, circuit mix and what must stay on private paths, not by a vendor template.
The work pairs with our Cybersecurity and Managed IT services. Segmentation, logging and monitoring are part of the design from the first diagram.
Leading platforms we work with
- Fortinet Secure SD-WAN
- Cisco Catalyst SD-WAN
- Palo Alto Networks Prisma SD-WAN
- Cloudflare
- HPE Aruba EdgeConnect
- Versa Networks
- Zscaler
- Netskope
Platforms and practices
- Application-aware routing
- Zero-touch branch provisioning
- Cloud on-ramps
- Secure web gateway
- Zero-trust network access
- CASB
- Underlay monitoring
- 5G and broadband failover
References
- Fortinet Secure SD-WAN (vendor page)
- Cisco Catalyst SD-WAN (vendor page)
- Palo Alto Networks Prisma SD-WAN (vendor page)
- Cloudflare Zero Trust products (vendor page)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
One overlay over three very different links
The SD-WAN overlay runs over MPLS, business broadband and LTE or 5G at once. Probes measure latency, jitter and loss on every path, and each application follows its own policy: when the MPLS path degrades, voice moves to the healthier link in moments while backups stay on the cheap one.
Access to one app, not to the network
Zero trust network access replaces the all-or-nothing VPN. The identity provider proves who you are, the device agent proves the laptop is healthy, the policy engine decides, and the enforcement point opens a tunnel to that single application and nothing else.
How we use SD-WAN & SASE for clients
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat is SD-WAN in plain terms?
It is software that watches several circuits at a branch, such as fiber, cable and 5G, and sends each application over the best one by measured loss, latency and jitter. It moves a call off a degrading link before users notice, and it lets a branch use cheaper broadband alongside or instead of MPLS. A central controller keeps policy consistent across sites.
Do we need a new SD-WAN product, or can our firewalls do it?
Many current firewall and router platforms include SD-WAN features, which saves a separate box and licence. We evaluate what you already own first and recommend a dedicated product only when you need features it lacks or very large scale. We list vendors we have worked with as experience, not as partnerships.
What is SASE and how is it different from SD-WAN?
SD-WAN decides how traffic travels between sites and the Internet. SASE, Secure Access Service Edge, adds cloud-delivered security on that path: a secure web gateway, zero-trust network access and a cloud access security broker. Many businesses start with SD-WAN and add the security services later.
Can 5G or broadband really replace MPLS?
For many offices, yes, with two diverse internet circuits and encrypted tunnels. MPLS offers a carrier service level and predictable latency, which broadband does not guarantee. We check what each application needs, such as voice and real-time systems, and measure the circuits before agreeing to drop MPLS.
How does multi-ISP failover behave for calls and VPNs in progress?
Sessions pinned to a failed circuit break unless they are re-established over the other path, which takes seconds to detect and re-form. Voice and video usually reconnect quickly; long file transfers may restart. Tunnel-based SD-WAN keeps the path address stable, and detection settings let us tune failover speed against false triggers.
How do you migrate branches without outages?
We stage one pilot site, validate policy and failover, then roll out site by site in maintenance windows with the old circuit kept as the rollback path. Zero-touch provisioning lets a device be shipped and brought up on site by non-technical staff. Each wave is checked against the monitoring baseline before the next.