MPLS vs SD-WAN — Indian Enterprise WAN Architecture

Read as

Last updated: May 1, 2026

MPLS is the legacy carrier-grade WAN — expensive, predictable, low-jitter, with operator-managed L3 VPNs. SD-WAN overlays multiple cheaper transports (broadband, LTE, 5G, MPLS) with software-defined policy, dynamic path selection, and integrated security. The Indian enterprise WAN is migrating fast: every BFSI and large enterprise is at some stage of MPLS reduction + SD-WAN expansion. This module covers MPLS fundamentals, SD-WAN architecture, the major vendors (Cisco Viptela, VMware/Velocloud, Versa, Fortinet), and the realistic migration path.

For two decades, “the corporate WAN” meant MPLS — leased L3 VPNs from Tata, Airtel, Sify, Reliance, BSNL connecting branches to headquarters and data centres. MPLS works well; it is also expensive, slow to provision, and rigidly policy-controlled by the carrier. SD-WAN — software-defined WAN — promises the same predictability over cheaper, more flexible transports plus integrated security. This module covers both worlds and the migration path that most Indian enterprises are now actively executing.

MPLS — what it actually is and why carriers like it

Multiprotocol Label Switching (RFC 3031) attaches small “labels” to packets at the carrier edge. Inside the carrier network, switches forward by label rather than IP — fast, simple, with operator-controlled paths. MPLS L3VPN uses VRFs (Module 13) per customer; each customer’s prefixes live in their own routing table, isolated from other customers on the same physical infrastructure. The customer-facing edge router (CE) talks BGP or static routes to the provider edge (PE); inside the carrier, BGP-VPN distributes routes; LDP or RSVP-TE assigns labels.

Why customers liked itpredictable latency and jitter, SLA-backed, the carrier handles reachability — the enterprise just connects branches and lets the carrier worry about paths.

Why it is being replacedcost (10-20× per Mbps versus broadband), provisioning lead times (weeks for new branches), and inflexibility (carrier-controlled, slow to adapt to traffic patterns).

SD-WAN — the architecture in one sketch

SD-WAN takes multiple physical transports — MPLS, broadband fibre, LTE/5G, satellite — and overlays an encrypted virtual network across all of them.

ComponentsEdge devices at each branch (Viptela vEdge, Velocloud Edge, Fortinet FortiGate-SD-WAN); controller (cloud-hosted or on-prem); orchestrator (templates, policies, monitoring).

Operationedge devices form encrypted tunnels (typically IPsec) to other edges and to data centre / cloud gateways; controller distributes policy (“route VoIP via MPLS, default via broadband”); edges measure path quality continuously and select dynamically.

Key innovations vs MPLSapplication-aware path selection (route Salesforce traffic differently from Office 365), automatic failover sub-second, zero-touch provisioning of new branches, and integrated security (firewall + IPS + URL filtering at every edge).

The major SD-WAN vendors and where they fit in India

Cisco Viptela / Cisco Catalyst SD-WANdominant in large enterprise, BFSI; integrates with on-prem Cisco; expensive but deep.

VMware Velocloud (now Broadcom)strong cloud-on-ramp (Office 365, AWS), simpler ops; popular in mid-market.

Fortinet Secure SD-WANintegrated security as default (FortiGate is also the SD-WAN edge), strong price/value; popular in mid-market BFSI and SMB.

Versa NetworksSASE-leaning, strong multi-tenant, popular with managed service providers.

Aruba SD-WAN (HPE)silver-peak heritage, strong WAN-optimisation.

Indian carriersTata Communications, Airtel, Sify, Vodafone Idea Business all offer managed SD-WAN — typically Cisco Viptela or Velocloud underneath, packaged as a service.

Choosingexisting security vendor (Fortinet shop → Fortinet SD-WAN); operational maturity (managed service if your team is small); cloud strategy (Azure-heavy → Velocloud cloud connectivity).

Application-aware steering — what makes SD-WAN better than dual-WAN

A naive dual-WAN setup load-balances by source IP or randomly. SD-WAN steers per-application: real-time apps (VoIP, video) on the lowest-jitter path even if it has higher cost; bulk traffic on the cheapest path; SaaS on the closest cloud-onramp.

How it knows the applicationsignature database (constantly updated) plus DPI on the first few packets; once identified, all subsequent packets in the flow are steered consistently.

How it measures path qualityBFD probes plus HTTP/ICMP synthetic transactions; metrics fed back to the controller hundreds of times per second per path.

What this gives youa video call that started on a degraded broadband link automatically migrates to LTE if SLA degrades — without user action.

What it does not give youmagic; sometimes the application database mis-classifies traffic, sometimes the path metrics oscillate. Plan for tuning.

Security in SD-WAN — the SASE convergence

SD-WAN edges naturally became security devices: terminating IPsec, doing NAT, running stateful firewall, running IPS, sending logs. The natural extension: integrate cloud-delivered security (SWG, CASB, ZTNA) so that branch traffic gets full inspection without backhauling to a central data centre. This convergence has a name: SASE (Secure Access Service Edge, Gartner term). The SD-WAN vendors are merging with security vendors: Cisco + Umbrella, Fortinet + FortiSASE, Cato Networks (built-from-scratch SASE), Zscaler + Aryaka (partnership).

For the Indian enterpriseSASE is increasingly the architectural answer — branch traffic goes to the nearest cloud security PoP for inspection, then to the destination; HQ no longer the choke point. SASE PoP coverage in India (Mumbai, Delhi, Bengaluru, Chennai) is the differentiator between vendors.

MPLS reduction — the realistic migration

Few enterprises remove MPLS entirely; most reduce it. Common end-state: MPLS retained on critical legs (DC to DC, BFSI core links with regulated SLA), broadband+LTE elsewhere, SD-WAN overlay across both. Cost trajectory: typical MPLS reduction yields 30-50% WAN OPEX cut once full-bore. Steps:

1Pilot SD-WAN on 5-10 branches; verify SLA and security.

2Expand to majority of branches; replace second MPLS link with broadband+LTE.

3Re-evaluate primary MPLS at each branch — many can move to “cheap broadband + LTE backup over SD-WAN”.

4Retain MPLS only where SLA-binding contracts require it (typical: BFSI core, hospital cards, critical-infrastructure links). Pitfalls: undersizing local internet (SD-WAN over a 50 Mbps broadband cannot replace 200 Mbps MPLS); ignoring last-mile reliability (Indian broadband quality varies dramatically by city and operator); forgetting that MPLS quality came in part from the carrier — broadband paths through ISP peering may have rougher behaviour at scale.

Indian context — TRAI, regulator expectations, and last-mile reality

Several specifics matter for the Indian WAN: TRAI licences carriers; SD-WAN provided as a managed service over Indian carriers is routine.

RBI / SEBI / IRDAIBFSI links between branches and core data centres are scrutinised; “MPLS or equivalent” remains the common safe answer; documenting why a broadband+LTE SD-WAN gives equivalent SLA is a 2025-era audit response that needs careful preparation.

Last-mile realityfibre availability varies by city (Tier-1 saturated, Tier-2/3 patchy); LTE/5G is increasingly ubiquitous and a viable secondary; satellite (OneWeb, Starlink in development for India) is the reliability backstop for remote branches.

Provider mixmost enterprises run two or three carriers per branch (Airtel + Jio + Tata) for redundancy; SD-WAN policy then ensures graceful failure across them.

Indian-data-residency angleSD-WAN tunnels to a central security stack should terminate inside India for DPDP-aligned visibility / forensic posture; ensure your SASE provider has Indian PoP coverage.

SD-WAN security posture audit — what to verify

When auditing an SD-WAN deployment, verify:

1Edge device certificates are issued by your internal CA (or vendor CA you trust); rotated periodically; revocation tested.

2Tunnels use modern ciphers (AES-256-GCM, IKEv2) and explicit cipher list (no negotiation surprises).

3Controller is reachable only from authorised management addresses; admin auth uses MFA and SSO.

4Branch local-internet egress applies the same security controls as HQ (URL filtering, IPS, malware scan); SASE PoP backhaul if the branch lacks local capacity.

5Configuration drift is detected: edge configs match the controller-pushed templates; alerts on local override.

6Telemetry from each edge ships to the central SIEM; ensure logs are not trapped on the edge alone.

7Failover testing verified quarterly: kill a path, verify reconvergence within SLA.

8Decommission process for retired branches: certs revoked, controller entries removed, transit cleaned up.

WAN cost optimisation — getting it right after migration

Post-SD-WAN, WAN spend reshaping involves a few decisions:

1MPLS retention — for which legs is MPLS still worth the price? Typical answer: critical regulated flows where the carrier SLA is the only acceptable contract.

2Broadband/LTE mix — pair fibre primary + LTE backup is standard; some sites use dual fibre from different carriers.

3Direct internet access vs central egress — for SaaS-heavy traffic, direct local egress with cloud SWG inspection wins on latency and cost; HQ-backhaul still appropriate for sensitive workflows.

4Bandwidth right-sizing — telemetry shows actual usage; many enterprises over-provisioned on MPLS legs and now right-size on broadband.

5Multi-cloud connectivity — SD-WAN edges peering directly with AWS Transit Gateway / Azure Virtual WAN reduce cloud egress costs and simplify routing. The post-migration year typically yields another 10-20% optimisation as actual patterns become visible.

Direct cloud connectivity — when SD-WAN should peer with the cloud

SD-WAN edges peering directly with cloud providers is the modern hybrid pattern. Cisco Catalyst SD-WAN, Velocloud, Versa, Fortinet all have integrations with AWS Transit Gateway, Azure Virtual WAN, GCP NCC. What this gives you:

1Branch-to-cloud traffic flows directly without backhauling to HQ, dramatically reducing latency for SaaS and cloud-hosted apps.

2Single SD-WAN policy plane for both private branch and cloud workload connectivity.

3Cloud-side routing visible in the same controller as branch routing.

4DDoS resilience because cloud peering rides over multiple paths. Architectural decisions: do you peer at the cloud edge (cloud onramp at provider PoP) or via direct interconnect (Direct Connect, ExpressRoute, Cloud Interconnect)? The former is cheaper and faster to provision; the latter is higher-bandwidth and SLA-backed. For Indian enterprises: AWS Mumbai, Hyderabad, and Azure South India regions all support cloud-onramp via partner SD-WAN providers; verify your SD-WAN vendor’s Indian region coverage as part of selection.

Diagrams

MPLS L3VPN — carrier-managed routing per customer

  Customer A         ┌───────────────┐         Customer A
  HQ ──CE──▶ PE ──▶│  Carrier core │◀── PE ◀── CE ──▶ branch
     (BGP/static)  │   (label-     │  (BGP/static)
                   │   switched)   │
                   │  Per-customer │
  Customer B       │  VRF tables   │         Customer B
  HQ ──CE──▶ PE ──▶│               │◀── PE ◀── CE ──▶ branch
                   └───────────────┘

  Same physical infrastructure, isolated routing per customer.

SD-WAN edge — multiple transports, single overlay

  Branch                                       HQ / DC
  ┌──────────┐    MPLS  ───────────────┐
  │          │── Broadband ────────────┼─▶ ┌──────────┐
  │ SD-WAN   │── LTE / 5G ─────────────┤   │ SD-WAN   │
  │   Edge   │                          │   │   Hub   │
  └──────────┘                          │   └──────────┘
        │ overlay tunnels (encrypted)   │
        │ across all available paths    │
        ▼                                ▼
     Application-aware steering by controller policy:
        VoIP   → MPLS  (low jitter)
        SaaS   → Broadband (cloud-onramp)
        Bulk   → cheapest available
        Backup → LTE on path failure

References & deeper reading

FAQ

Will SD-WAN entirely replace MPLS in 5 years?

No, but the ratio shifts. Critical regulated links (BFSI core, government) keep MPLS. Most other traffic moves. By 2030 most enterprise WAN spend will be SD-WAN-led with MPLS as a premium reliability tier on specific legs.

Is managed SD-WAN better than DIY?

For most enterprises in India, yes — your carrier already has the technology + Indian-context support. DIY makes sense if you have a strong network team and want fine-grained control. Most BFSI run managed; most tech companies DIY.

How do I size a branch broadband for SD-WAN?

Total expected concurrent user traffic + VoIP/video reservation + 50% headroom. A 50-user branch with VoIP, video, and SaaS: 200-500 Mbps primary + LTE backup is typical 2026 sizing. Always provision for the failure case (one path down, all traffic on the other).

Does SD-WAN replace my firewall?

For perimeter security at branches, increasingly yes — modern SD-WAN edges (Fortinet, Cisco Meraki MX) include full NGFW. For data centres and HQ, separate firewalls remain typical. The integrated edge is sufficient for branch sizes; central concentrators justify dedicated firewalls.

What about 5G as primary WAN transport?

Increasingly viable for branches, especially Tier-2/3 cities where fibre is patchy. Indian carriers (Jio, Airtel) offer enterprise 5G with QoS guarantees. Pair with broadband for diversity; do not rely solely on 5G for production-critical traffic until the operator SLA matures further.

How long does an SD-WAN migration take?

For a 50-200-branch enterprise: 9-18 months end to end (planning, pilot, full rollout). The pilot phase (5-10 branches) usually runs 2-3 months; learnings reshape the broader deployment. Plan for parallel-running with MPLS for at least one carrier-billing cycle on each branch.

Will my BFSI regulator object to SD-WAN?

They will scrutinise. Documenting the SLA equivalence (or improvement), the security posture, and the operator track record matters. Many large Indian banks have approved SD-WAN deployments now; the path is well-trodden. The defensible strategy is to keep MPLS on regulated-critical legs and use SD-WAN to lower cost and improve flexibility on the rest.

⚖️ Legal: Use any techniques described here only on networks you own or have explicit written authorisation to test. In India, unauthorised access is punishable under IT Act §66 (up to 3 years + fine). Pair offensive testing with a signed Statement of Work / Rules of Engagement; pair forensic activity with §65B-aligned chain of custody.

Want this for your team?

Custom team training + practitioner advisory

Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.

Book team training call Replies in 4 working hrs · India-only · Senior consultants

MPLS, SD-WAN, and the Indian Enterprise WAN