SD-WAN Solutions

The second is whether the firewall is the edge or sits behind it. In many branch designs the SD-WAN appliance and the security appliance are the same box, and its throughput with inspection enabled becomes the constraining number. In others the edge device passes traffic to a separate firewall, which is a cleaner separation of duties and one more device per site to buy, power and rack. Both are defensible; what is not defensible is discovering which one you chose at deployment.

The third is site tiering. Estates are never uniform, but they are almost always reducible to three or four repeatable templates plus a short list of exceptions — a distribution center, a regional office, a small branch, and the two sites that are unlike anything else. Tiering is what turns a rollout into a repeatable order; without it, every site is a bespoke quote and the program slows to the pace of its purchasing.

The fourth is what happens at the aggregation points. Regional hubs and data center terminations are usually larger appliances with their own licensing, and they are frequently forgotten in a budget that was assembled by counting branches. They belong on the same document as the branches, because they are on the same critical path.

Freezing the template is what makes the rest of it repeatable. It converts a hundred bespoke site visits into a hundred instances of the same visit, which is what allows staging to do its job — because a staged unit is only useful if the thing it was staged against has stopped changing. It also makes the quote stable, since a frozen template is a fixed bill of materials that can be priced once and reordered.

The order in which sites go live is worth deciding deliberately rather than alphabetically. Sites whose circuits are already installed go first; sites waiting on a carrier build go last regardless of their priority, because no amount of staging accelerates a construction interval. We release shipments against that sequence rather than pushing the whole estate to a dock that cannot store it.

We also do not carry a cloud-security or SASE practice. Where an architecture includes a cloud-delivered security service, that is a subscription relationship between your organization and that vendor, and we would rather point at the boundary than blur it to look broader. On the same principle, we make no uptime, availability or performance commitment on a network we do not operate.

And the transports are not part of this scope. The access underneath an SD-WAN — dedicated internet, broadband, private lines, cellular airtime — is carrier service on its own contracts and its own budget line, quoted separately from the appliances and licensing on this page, and in most programs already in place before the overlay conversation starts. What this page quotes is the hardware that terminates those transports and the subscriptions that hardware requires, sourced through authorized US distribution and screened line by line.