SD-WAN for two sites: necessary, or oversold?
Usually oversold. SD-WAN measures several internet paths and steers traffic by application, and almost all of that is available at two sites from a firewall you already own. Microsoft's own optimization table ranks migrating to SD-WAN fifth of five methods, below local egress and split tunnelling.
- Microsoft's own optimization table ranks migrating to SD-WAN fifth of five methods, and credits it with manageability rather than lower latency.
- Four of the five capabilities SD-WAN is sold on already ship in a business firewall, including policy-based routing, path monitoring and an encrypted site tunnel.
- Path selection needs a better path to select. Cisco documents that when no tunnel meets the SLA, traffic is sent down one of the available ones.
- Central management is priced for scale. Palo Alto sizes its SD-WAN manager at 16 CPUs and 64GB of memory for up to 500 managed devices.
- Every deployment adds an administrative interface. CISA gives federal agencies 14 days to act on an internet-exposed management interface.
Does a two-site business need SD-WAN?
Usually not. SD-WAN earns its price across many sites, several transport types, and traffic worth routing differently at each one. A two-site business whose applications live in someone else's cloud has little of that, and most of what it has sits in the firewall it owns.
The clearest evidence comes from a vendor that does not sell it. Microsoft defines SD-WAN as software that simplifies WAN management and improves performance by replacing traditional WAN routers with virtual appliances. Management comes first in that sentence.
Microsoft then publishes a table of optimization methods ordered by their effect on latency and reliability for the largest number of users. Migrating from a traditional WAN to SD-WAN is the fifth and last row. The four rows above it cover local DNS and egress, regional egress points, proxy bypass and VPN split tunnelling, each credited with minimizing latency. SD-WAN is credited with improving the performance and manageability of WAN traffic and reducing load on network devices, which is a smaller claim.
This guide tests the technology one capability at a time. It does not re-cover automatic failover, which internet failover for a small business covers in detail, or the voice measurements behind call complaints, which belong to call quality is not the phone system.
What SD-WAN actually is, and what it is not
SD-WAN is an overlay. It is software that sits on the internet circuits you already buy, measures them, and decides which traffic takes which. It does not deliver a circuit.
MEF 70.1, published in November 2021, defines the externally visible behavior of SD-WAN Services and warns that it is important to distinguish between the SD-WAN Service and the Underlay Connectivity Services. The underlay connectivity is your fibre and your cable. An overlay cannot turn one underlay into two, so software never fixes a single physical path into your building.
The architecture also brings more parts than a firewall. Cisco names four fundamental components and notes that, setting the edge router aside, the remaining three are software-only components, namely a manager, a controller and a validator. Cisco adds that a typical overlay network includes multiple controllers in each domain. A two-site business runs that control plane for two devices.
The five capabilities, and which one actually needs SD-WAN
Five capabilities carry almost every SD-WAN pitch. Four already ship in a business-grade firewall. Only the fifth is a genuine addition at two sites, and central configuration is an argument about scale.
Policy-based path selection
Policy-based path selection already ships in the firewall. Palo Alto Networks documents policy-based forwarding as a feature that allows you to override the routing table and specify the outgoing or egress interface, matching traffic based on specific parameters such as source or destination IP address, or type of traffic. Its own example chooses to route business-critical applications over the leased line while sending all other traffic, such as web browsing, over the cheaper link.
Application-aware routing
Application-aware routing is the one real capability gap, and it is narrower than it sounds. Cisco documents that it tracks network and path characteristics of the data plane tunnels and uses the BFD Hello packets to measure the loss, latency, and jitter on the links. It is also slower than buyers assume. The default BFD Hello packet interval is 1 second, the default poll interval is 10 minutes, and the classification uses the last six poll intervals. On defaults, a steering decision rests on about an hour of averaged measurement.
Link health monitoring and failover
Link health monitoring is a base firewall feature too. Palo Alto documents path monitoring on an ordinary forwarding rule, which allows you to verify connectivity to an IP address so that the firewall can direct traffic through an alternate route and uses ICMP pings as heartbeats. Your firewall can monitor a redundant path today.
An encrypted tunnel between your sites
A site-to-site VPN runs on a standard published in 2005. The IETF released its IPsec security architecture, designed to provide interoperable, high quality, cryptographically-based security, in December 2005, noting that an SA between two security gateways is typically a tunnel mode SA. Any business firewall will encrypt that link. SD-WAN adds one thing worth paying for, holding a tunnel up over every transport at once, so traffic moves between the available tunnels instead of rebuilding one.
Why central management is an argument about scale
Central management is priced for hundreds of sites, not two. Palo Alto Networks specifies the Panorama management appliance for SD-WAN at 16 CPUs, 64GB memory and a 224GB system disk, then states that the above information applies to a maximum of 500 managed devices. That is its entry specification.
Microsoft says the same about its own guidance. Large enterprises with many locations need to develop a strategy that includes most or all of the principles, while smaller organizations might only need to consider one or two. Configuring two devices by hand is not the problem this tooling was built to solve.
There is a fair version, and it belongs to your provider. A managed service provider running your two sites beside eighty others gets real value from one console. Ask whose saving that is.
The traffic moved, so measure yours before you buy
If your cloud-based applications sit in someone else's data centre, the link between your offices carries less than the pitch assumes. Microsoft states the consequence plainly. Direct internet access should be prioritized for the Microsoft 365 domains by reducing reliance on wide area network backhauling.
The reason is geographic. Microsoft routes each connection to its nearest entry point, so in most cases the best user experience is achieved by allowing the customer network to route user requests to the closest Microsoft 365 service entry point, which it calls preferable rather than connecting through an egress point in a central location or region. Sending branch office traffic to head office to be steered is the habit that guidance exists to break, so do not backhaul it.
No published figure tells you how your own business splits traffic between cloud applications and the other office. The split is a measurable fact about your network, not an industry average. Ask for four things before you sign.
- Name every application that travels between the two offices, with the share of traffic each accounts for. A file server or an on-premises phone system qualifies. Anything reached over the public internet does not.
- Measure both circuits at each office across a full working week, reporting packet loss, latency and jitter rather than a speed test. Microsoft publishes a connectivity test for exactly this.
- Describe what happens today when one circuit fails, naming the device that detects it and the sessions that drop. If nobody can answer, your gap is failover.
- Price the alternative beside it, meaning a second internet circuit plus policy routes you configure on the firewall you own, against the overlay with its licences and management plane.
A proposal that answers all four is an engineering recommendation. One that skips the first sells path selection without establishing that a better path exists.
When two sites do justify SD-WAN
Four conditions justify SD-WAN at two sites, and they tend to arrive together. One alone rarely pays.
- Real site-to-site traffic, meaning an application hosted at one office that staff at the other use all day.
- Three or more transports across the two sites, such as fibre, cable and a cellular link, giving path selection something to choose between.
- Sessions that cannot drop, because a voice platform, a terminal session or a payment integration holds state a rebuild breaks.
- Growth already dated, meaning a third and fourth site on the plan, since the economics improve with every site added.
The sharpest test sits in Cisco's own documentation. If no tunnel matches the SLA, data traffic is sent through one of the available tunnels. Path selection needs a better path to select. With two congested circuits at four in the afternoon, the software has the same two poor options a dual WAN router had.
The cost nobody prices: another management plane
Every deployment adds an administrative interface somebody must keep off the public internet. CISA requires federal agencies to act within 14 days of notification by CISA or discovery by an agency, either to remove the interface from the internet or to enforce zero-trust access control on it.
The scope CISA names is ordinary business equipment, covering routers, switches, firewalls, VPN concentrators, proxies, load balancers, because inadequate security, misconfigurations, and out of date software make these devices more vulnerable to exploitation.
In August 2024 CISA published an advisory on a flaw in Versa Director, which it described as a product used to manage SD-WAN networks, warned that a cyber threat actor could exploit this vulnerability to take control of an affected system, and confirmed it had added this vulnerability to its Known Exploited Vulnerabilities Catalog.
That does not make SD-WAN unsafe, and no honest provider promises any design is. The management plane is part of the purchase. Ask who patches the orchestrator and whether its admin interface faces the internet.
FAQ
Which SD-WAN capabilities does a business firewall already have?
A business firewall already has four of the five. Policy routing that overrides the routing table per application, path monitoring that checks a link and steers away when it fails, local internet egress, and an encrypted site-to-site tunnel. The fifth, holding several transports live at once and moving traffic between them per application, is the part you are actually buying. Microsoft's own optimization table ranks migrating to SD-WAN fifth and last among its connectivity methods, and it is the only row there that does not promise to minimize latency.
What does SD-WAN do that a dual WAN router does not?
It measures each path continuously, steers individual applications, and holds a tunnel live over every transport at once. Cisco documents that it uses the BFD Hello packets to measure the loss, latency, and jitter on the links. A dual WAN router switches the whole connection instead.
Does SD-WAN replace a second internet circuit?
No. SD-WAN is an overlay on circuits you still buy separately. The MEF standard states that it is important to distinguish between the SD-WAN Service and the Underlay Connectivity Services. If both circuits enter your building through one conduit, the overlay changes nothing.
How much site-to-site traffic justifies SD-WAN?
Enough that an application hosted at one office is used all day from the other. Where email, files and the phone system are cloud services reached over the public internet, little office-to-office traffic remains. Microsoft advises reducing reliance on wide area network backhauling.
What should a provider show you before quoting SD-WAN?
Ask for three things before you agree a price. Which applications actually run between your two offices rather than out to a cloud service, because that traffic is the only kind the path selection improves. Measured latency, loss and jitter on the circuits you already have, not a brochure figure. And what happens today when one link fails, tested in front of you rather than described. A quote that arrives without those three is priced on a guess about your network.
Best IT MSP is the independent directory of vetted managed IT and network providers across the US and Canada. Organic ranking is earned on verified data, and paid placement is labelled. Take the four questions above to three merit-ranked firms and compare the answers.