MPLS vs SD-WAN: Carrier Circuit or Software Overlay

An MPLS network forwards on a label, not on the destination address. The ingress provider-edge router classifies a packet and pushes a label; every core router swaps the label from a table and forwards; the egress router pops it. RFC 3032 fixes the label stack entry at 32 bits: a 20-bit label, a 3-bit field for class of service (the Exp field, since renamed Traffic Class), a 1-bit bottom-of-stack flag and an 8-bit time-to-live. The customer never touches any of this. What the customer buys is the service on top, almost always a BGP/MPLS IP VPN under RFC 4364, in which the provider keeps a separate routing table (a VRF) for each customer so that one customer's sites cannot reach another's.

The class of service is where the commercial value sits. Three bits give at most eight markings, and RFC 3270 defines how a single label-switched path (an E-LSP) carries up to eight behavior aggregates; a carrier typically sells a handful of them: a real-time class for voice and video, one or two priority data classes, and best effort. Each class comes with a contracted target for loss, latency and jitter measured across the carrier's network, and that contract is what an application owner points to when a call-quality complaint arrives. The limits are just as concrete. The SLA covers the carrier's cloud up to the demarcation point, not the customer's equipment beyond it, and RFC 4364 is explicit that the VPN does not by itself encrypt data: separation is by routing, not cryptography, so confidentiality across the circuit is a separate IPsec decision.

MEF 70.2 describes an SD-WAN service as an overlay over one or more underlay connectivity services, which may be supplied by other providers. Between two edges the service builds tunnels, each with its own performance and security characteristics, and encryption is applied per tunnel. Packets arriving at a site are classified into application flows, and a policy attached to each flow states its performance targets, whether it may break out to the internet locally, and which paths it may use. That policy is written once, in the controller, and pushed to every edge; adding a site becomes installing an appliance that fetches its configuration rather than a router that someone configures by hand.

What replaces the carrier SLA is measurement. Each edge probes every tunnel for loss, latency and jitter and moves a flow when its current path falls outside the thresholds its policy allows. WatchGuard's documented example for exactly this case, a site with voice on an MPLS link and a VPN tunnel over the internet behind it, uses the default failover thresholds of Fireware 12.5.4 and later, 5% loss, 400 ms latency and 100 ms jitter, with failback to the circuit once it recovers. Other platforms use their own probes and defaults. The point that matters to a buyer is where the guarantee lives: the overlay can only choose among the paths it has, so a site whose underlays are one broadband line and a cellular modem has no guaranteed path at all, only the better of two measured ones.

The two are not exclusive, and the head-to-head framing hides the design many migrations pass through. An MPLS circuit is a good underlay: the overlay builds a tunnel across it exactly as it does across a dedicated internet circuit, and policy pins the flows that need the contracted class of service to that tunnel while everything else rides the cheaper links. That keeps the carrier's SLA for the traffic with a contractual reason to want it, and stops paying premium transport for backups, software updates and SaaS sessions that never needed it.

Migration then becomes a sequence rather than a cutover. New sites open on dedicated internet or broadband plus cellular, with the overlay from day one. Existing sites get the appliance in front of the MPLS router and start steering non-critical flows off the circuit; by the time the circuit contract comes up for renewal, the organization holds months of measured data on whether the internet paths met the application targets, and the renewal becomes a decision on evidence. Where the answer is no, the circuit stays, with the overlay on top of it.

An MPLS network is bought as circuits: one carrier order per site, a customer-edge router per site, and a central firewall that every internet-bound packet passes through. An SD-WAN network is bought three times: an appliance per site, sometimes two for redundancy; a subscription per site or per bandwidth tier that renews on its own schedule; and the transports underneath, which now come from more than one provider. The security line moves as well. Once a branch breaks out to the internet locally, the central firewall no longer sees that traffic, so the edge needs a next-generation firewall built in, a separate one beside it, or a cloud security service that inspects the breakout (the overlay bundled with that cloud service is what the market sells as SASE), and each of those is a separate line with its own term. Size the appliance on throughput with encryption and inspection turned on, not on port count.