WAN Technologies & SD-WAN
Compare leased lines, MPLS, and internet-based VPN, understand why SD-WAN emerged, and weigh the security tradeoffs of local breakout versus centralized backhauling.
Learning Objectives
- → Distinguish a LAN from a WAN and explain the 'last mile' concept
- → Compare traditional WAN technologies: leased lines, MPLS, and internet-based VPN
- → Explain what SD-WAN is and why it emerged as an alternative to MPLS
- → Distinguish underlay and overlay networks in an SD-WAN deployment
- → Explain the security tradeoffs of local breakout vs backhauling branch traffic
LAN vs WAN: Scope, Not Just Size
A LAN is a network you own end-to-end (an office, a building). A WAN connects separate locations across infrastructure you typically don't own — telecom carrier circuits, the public internet, or a mix. The last mile is the final physical link connecting a specific site to that carrier's network — often the least reliable, hardest-to-upgrade segment of the whole path.
Traditional WAN Technologies
| Technology | How it works | Tradeoff |
|---|---|---|
| Leased line | A dedicated, always-on circuit (e.g. T1, dedicated fiber) between two points | Reliable and private, but expensive and slow to provision |
| MPLS (Multiprotocol Label Switching) | Carrier-managed private network using labels to fast-forward traffic without full IP lookups at every hop | Predictable performance and built-in QoS, but expensive and locks you into one carrier's footprint |
| Internet-based VPN | Encrypted tunnels over the public internet | Cheap and flexible, but subject to public internet congestion/latency |
Why SD-WAN Emerged
MPLS's cost and rigidity became harder to justify as more traffic (SaaS, cloud apps) headed to the public internet anyway rather than to a company's own data center. SD-WAN (Software-Defined WAN) lets an organization intelligently route traffic across multiple underlying WAN links (MPLS, broadband internet, LTE/5G) based on real-time policy — cost, performance, and application type — rather than being locked into a single carrier's path.
Underlay vs Overlay
- The underlay is the actual physical/carrier transport (MPLS circuit, broadband internet, LTE) — SD-WAN doesn't replace this, it rides on top of it
- The overlay is the software-defined layer SD-WAN builds on top of multiple underlays — encrypted tunnels, centralized policy, and application-aware routing that make the diverse underlays behave like one manageable network
Local Breakout vs Backhauling: A Security Tradeoff
Historically, all branch-office traffic — including traffic destined for the public internet — was backhauled through a central data center for inspection before reaching the internet. SD-WAN makes local breakout (sending internet-bound traffic directly out from the branch) practical and fast, but it means centralized security inspection (firewall, proxy, DLP) has to be replicated at every branch instead of just one central choke point — a direct tradeoff between latency/cost and centralized security control.
Common Pitfalls
- Adopting local breakout for performance without replicating adequate security inspection at each branch
- Assuming SD-WAN "replaces" the underlying links — it's an orchestration and policy layer riding on top of underlays that still need to exist and be provisioned
- Treating MPLS as inherently more secure than internet-based VPN — MPLS is private but not encrypted by default; a VPN's encryption is a materially different security property than MPLS's carrier isolation
The final physical link connecting a specific site to a carrier's network is often the weakest part of the whole path.
What is the 'last mile' in WAN terminology?
MPLS trades cost and vendor lock-in for predictable, carrier-managed performance.
What is the primary tradeoff of MPLS compared to internet-based VPN?
SD-WAN's overlay is software; the underlay is the physical transport it rides on top of.
In an SD-WAN deployment, what does the 'overlay' actually consist of?
💪 Exercises & Challenges
WAN Technologies & SD-WAN MCQ
Test your understanding of WAN Technologies & SD-WAN.
Design a Hybrid WAN Policy
A company has 3 branch offices, each with an MPLS circuit and a broadband internet connection. Design an SD-WAN policy describing which traffic type should use which underlay (e.g. VoIP, SaaS/cloud ap
Diagnose the Post-Migration Security Gap
A company migrates from MPLS-only backhauling to SD-WAN with local breakout to cut WAN costs. Six months later, a branch office reports a phishing-delivered malware infection that spread laterally bef