SD-WAN and SASE: The New Paradigm in Enterprise Networking

SD-WAN (Software-Defined Wide Area Network) and SASE (Secure Access Service Edge) integrate networking and security into a unified architecture, optimizing connectivity between locations and applying Zero Trust policies to users, devices, and cloud resources.

Key points:

In enterprise environments, the network is no longer just a collection of connections that need to be kept up and running. It is the platform that delivers ERP, CRM, Unified Communication and Collaboration (UCC) services, and artificial intelligence solutions from the data center to the cloud and out to branch offices. Each location is also an access point that must be secured, while users, devices, and applications are increasingly distributed. Performance and security therefore cannot remain separate domains, managed with distinct tools and controls. SD-WAN and SASE thus converge into a single architecture that integrates connectivity, traffic management, and security, with policies defined and enforced centrally. For enterprise organizations, this means having a scalable and flexible network that adapts to business evolution and ensures speed, continuity, and protection for increasingly cloud-oriented IT environments.

The Limitations of the Traditional Corporate Network in the Cloud Era

The traditional corporate network connects branch offices to the data center via dedicated MPLS (Multiprotocol Label Switching) circuits and also routes traffic to the Internet through the central hub: a model designed for centralized internal applications and resources, which can introduce latency and inefficiency when accessing cloud services.

For years, MPLS technology has been the standard for enterprise wide-area networks: data travels along predefined paths within the carrier’s network, with guaranteed priority for voice and video. In the hub-and-spoke model, branch offices connect to the data center, which also houses firewalls and Internet access. This architecture ensures predictable quality but restricts each location to fixed routes and a single exit point: to reach a SaaS (Software as a Service) application, traffic must first pass through the central hub, resulting in bottlenecks and slower scalability. For this reason, dynamic route selection—which chooses the best path in real time—represents a significant leap forward in network intelligence.

SD-WAN and SASE: What Are They, and What’s the Difference?

SD-WAN is the network layer that manages locations via software and routes traffic by application; SASE adds a cloud-delivered security layer that protects users, locations, and applications wherever they are.

The two acronyms address different issues. SD-WAN determines the best way for traffic to reach its destination. SASE determines who can access what, from where, and under what conditions. The former focuses on links and routes, while the latter focuses on identities, policies, and content inspection. An SD-WAN without built-in security leaves local exit points wide open. A SASE without a robust underlying network protects traffic but does not guarantee its performance. This is why the market is moving toward single-management platforms.

SD-WAN (Software-Defined Wide Area Network): an architecture in which the wide area network is managed via software by a centralized orchestrator, which dynamically coordinates multiple connections and routes traffic based on application requirements and real-time network conditions.

SASE (Secure Access Service Edge): an architecture introduced by Gartner in 2019 that combines networking and security functions—such as SD-WAN, Firewall as a Service, ZTNA, CASB, and Secure Web Gateway, to protect locations, remote users, and applications from a single console.

Originally conceived as a convergence of network and security services, SASE has evolved into a comprehensive architecture designed for enterprises that have migrated their applications and data to the cloud.

Does SASE replace SD-WAN or incorporate it?

SASE does not replace SD-WAN: it incorporates it as a network component and complements it with cloud security services. SD-WAN remains the engine that selects the path between offices, data centers, and the cloud, while SASE adds a single policy layer for branch offices, mobile users, and applications. The most advanced platforms also integrate artificial intelligence, which accelerates threat detection, dynamically optimizes network paths, and automates compliance checks.

According to Gartner (Magic Quadrant for SASE Platforms, July 2025), by 2028, 70% of SD-WAN purchases will be part of a single-vendor SASE offering, up from 25% in 2025. Gartner’s SASE forecast estimates a market size of $28.5 billion in 2028, with an annual growth rate of 26%. Those who upgrade their network today can avoid a second migration by choosing an SD-WAN that is SASE-ready.

The Architecture of a Smart Network: Underlay, Overlay, and Security Layer

A multi-site intelligent network consists of three layers: the underlay of physical links, the SD-WAN overlay that determines the routes, and the SASE layer that applies security policies to each session.

At the core is the underlay—that is, the physical connections at each location: dedicated fiber, IPVPN (IP Virtual Private Network) circuits, FWA (Fixed Wireless Access) connections, 4G and 5G networks, and satellite. Above this operates the SD-WAN overlay: the devices create IPsec-encrypted tunnels between locations and to the cloud, measure the quality of each line, and reroute traffic in real time. At the very top is the SASE layer, which inspects traffic and verifies the identity of users. A single orchestrator manages all three layers.

• Underlay: fiber, IPVPN, FWA, 4G/5G, and satellite, including from different providers.
• SD-WAN Overlay: encrypted tunnels, latency and jitter measurement, dynamic route selection.
• SASE Layer: cloud firewall, zero-trust access, web filtering, SaaS application control.

Where do SD-WAN and SASE fit into the network architecture?

SD-WAN is located at the intermediate layer, between the physical links and the applications, while SASE is located at the top layer, between users and the resources they access. SD-WAN ensures that traffic arrives with the required quality; SASE ensures that only authorized, threat-free traffic arrives.

Mapping the network across the three levels helps us understand which components need to be replaced immediately and which can remain in service.

Network and Security Convergence: Firewall as a Service and Zero Trust Network Access

Zero trust is a security model that does not grant implicit trust to any user or device: Firewall as a Service applies its controls to network traffic, while zero trust network access applies them to application access.

With cloud-based applications and branch offices that connect directly to the Internet, security can no longer be concentrated at a single point in the network. The convergence of networking and security distributes controls along the entire path of traffic and governs them with a single set of policies.

Zero trust: a security model based on the principle of "never trust, always verify," in which every access request is authorized only after verifying the user's identity, device, and context.

The zero-trust model is based on three principles:

• Continuous verification: Identity and device are verified with every login.
• Least privilege: Each user has access only to the resources necessary for their role.
• Micro-segmentation: Resources are isolated, so any compromise remains contained.

What does Firewall as a Service do?

Firewall as a Service is a next-generation firewall delivered from the cloud rather than from an on-premises device. It inspects incoming and outgoing traffic, applies centrally defined rules, and blocks threats using intrusion prevention, web filtering, anti-malware, and application control. Policies are consistent across locations and users, and capacity scales with traffic volumes without requiring new hardware. Firewall as a Service integrates with SD-WAN and a Managed Detection and Response service for continuous monitoring.

What does ZTNA do, and why is it better than a traditional VPN?

ZTNA (Zero Trust Network Access) connects the user to a single authorized application, not to the entire network. Before establishing the connection, it verifies the user’s identity and device; the applications remain invisible to those without permissions. A traditional VPN (Virtual Private Network), on the other hand, grants the authenticated user access to the network: with stolen credentials, an attacker can move freely between systems. For NIS2 (Network and Information Security) entities, ZTNA supports the access and authentication measures outlined in Article 21, as indicatedby the National Cybersecurity Agency and the European Commission.

The ENISA Threat Landscape 2025 analyzed 4,875 incidents: phishing is the initial intrusion vector in approximately 60% of cases.

SD-WAN vs. MPLS vs. SASE: Selection Criteria for Enterprise Networks

MPLS offers predictable but inflexible quality; SD-WAN adds agility and intelligent use of multiple links; SASE extends protection to users and the cloud: the choice depends on applications, the number of locations, and security requirements.

The three models are not mutually exclusive alternatives. Many enterprise networks combine an MPLS circuit for the most sensitive traffic, an SD-WAN that orchestrates all connections, and SASE services for remote users and local access points. This comparison should be viewed in light of three key factors: operational complexity, exposure to cyber threats, and the balance between cost and performance.

Criterion	Traditional MPLS	SD-WAN	SASE
Objective	Connecting locations with guaranteed quality	Optimizing Routes and Applications	Combining Networking and Security in the Cloud
Cloud Access	Headquarters Address	Local Exit with Optimal Route	Local Output Inspected from the Cloud
Available lines	Operator Circuits	Fiber, radio, 4G/5G, satellite, MPLS	SD-WAN users plus remote users
Safety	Circuit isolation, central firewall	Encrypted tunnels, on-premises firewalls	Cloud firewall, ZTNA, CASB, web filter
New Locations	Weeks, with technical support	Zero-touch, automatic configuration	Instant for remote users
Management	Device by device	Central Orchestrator	Single Network and Security Console
Cost Model	Bandwidth fee, not very flexible	A mix of lines and standards for the apparatus	Subscription per user or per location

Does SD-WAN completely replace MPLS?

SD-WAN does not necessarily replace MPLS; it often complements it as one of the available options. Voice, video, and business applications can remain on the IPVPN network, while traffic to the Internet and public clouds exits through the local access point.

From SD-WAN to SASE: A Gradual Adoption Path

The transition to SD-WAN and SASE is proceeding gradually and generally involves the following areas: application mapping, a redundant underlay, an SD-WAN overlay with built-in security, and the extension of the zero-trust model to users and the cloud.

A phased approach reduces risks and minimizes the initial investment. SD-WAN is rolled out to a pilot group of locations, while the rest of the network remains unchanged. SASE features are enabled first on Internet egress points and then on remote access points.

• Assessment and application mapping: inventory of locations, lines, critical applications, and data flows to data centers and the cloud.
• Redundant multi-technology underlay: at least two different access methods for critical locations, including fiber, radio, mobile, and satellite.
• SD-WAN overlay with built-in security: devices with next-generation firewalls, application-based rules, and service thresholds.
• SASE and Zero Trust: Cloud-based protection for on-premises egress and zero-trust access for remote users.

How do you migrate a multi-site network without taking the sites offline?

A multi-site network is migrated without downtime by activating the SD-WAN site by site, in parallel with the existing network. With zero-touch provisioning, the device arrives at the branch, connects to power and the Internet, and downloads the configuration from the orchestrator. A real-world case managed by Retelit in the logistics sector—involving over 200 locations and critical 24/7 data flows—followed this approach. Each location received redundant connectivity: fiber, last-mile connections from other carriers, radio links, and LTE/5G backup, with the customer’s SD-WAN orchestrating the network. Similar approaches were used in case studies on a resilient MPLS and SD-WAN network in the energy sector and ona national infrastructure for the fashion retail industry.

A pilot program at a few representative locations allows us to validate rules and thresholds before extending them to the entire network.

Managed Services for SD-WAN, SASE, and Cloud Security

A managed SD-WAN and cloud security service consolidates networking and security functions with a single provider or a small number of partners: this simplifies management and gives the organization access to integrated expertise in design, transport, and security.

The SASE model was designed to consolidate, into a few services provided by a single vendor or a limited number of partners, networking and security functions that would otherwise require many different vendors. Fewer platforms to integrate mean faster operations and simpler management. In a managed service model, the value increases even further, because the service is combined with complementary expertise in transport and networking: the organization receives dedicated solutions, expert infrastructure design, and integrated services all under a single umbrella.

How are SD-WAN and security integrated into a managed service?

In a managed service, the provider designs, deploys, and maintains both the network and security over time. Security features, such as firewalls, intrusion prevention, web filtering, and anti-malware, reside within the SD-WAN devices installed at each location, while a central orchestrator enforces uniform policies across the entire network. Traffic to the Internet and the cloud passes through Firewall as a Service, and a Security Operations Center (SOC) continuously monitors events and threats. Management can be entrusted entirely to the provider’s specialists or shared with the internal IT team, which retains visibility and control over configurations.

The infrastructure underpinning the service is also a strategic element, because it is essential for companies to know where their data is processed and stored: In its 2026 Magic Quadrant for SASE Platforms, Gartner identifies this aspect as one of the new criteria for selecting platforms. In Italy, Retelit delivers its SD-WAN and managed security solutions on a proprietary infrastructure that includes a 47,000-km backbone network with capacity of up to 800 Gbps and a dedicated SOC.

Frequently Asked Questions About SD-WAN and SASE for Enterprise Organizations

With contributions from Renzo Cavalli, Product Marketing & Go to Market, Retelit