SD-WAN and SASE are two popular networking technologies for connecting users and devices at any time and from any location. As their networks evolve, companies must decide if SASE or SD-WAN is the right answer for them. Let’s take a deeper look at each of these approaches to have a better understanding of the various factors that businesses should consider before choosing the ideal networking technology.
Remember when the software-defined area network (SD-WAN) was considered a new thing? It wasn’t that long ago. While its roots go back to the dawn of the century, networking publications started using the term SD-WAN frequently in 2014Opens a new window . Now the conversation is starting to shift to Secure Access Service Edge or SASE, a technology that Gartner only recently publicized in 2019. Now we are having them face off against one another from the opposite corners of the ring. So, what are the differences between these two technologies and how are they the same? Is one better than the other? Below is a list of tips to help you gravitate to the preferred choice based on your needs.
Defining SD-WAN
According to GartnerOpens a new window , SD-WAN solutions provided a replacement for traditional WAN routers that are agnostic to WAN transport technologies and provide a dynamic, policy-based application selection path across multiple WAN connections. SD-WAN is a network architectural approach that helps overcome the performance challenges of legacy technologies such as MPLS and VPN that service multiple sites across a geographically dispersed WAN. It uses a virtual overlay network that routes packets automatically via the most optimal route. This virtual overlay resides on top of the physical topology of the network. Â
See More: Hype or Help: Should Organizations Rely on SASE for Network Operations?
Let’s say a user at a remote district office wants to edit a document hosted on O365. Rather than backhauling the traffic all the way to the central data center to get to the internet, 0365 destined traffic is immediately routed out an auxiliary router located at the site that directs to the O365 cloud. This alleviates strain on the WAN and makes the user experience faster. It will also route the on-premise ERP traffic, prioritizing other traffic types. Using a centralized SD-WAN control console, network admins can also allocate more bandwidth to certain pipes to meet increased demand from a particular site. Â
Similarities Between SD-WAN and SASE
Like SD-WAN, SASE uses a software-based approach that utilizes a virtualized network overlay across an existing network structure to connect geographically dispersed endpoints. Both allow for centralized management from anywhere, giving admins the ability to manage network traffic and deliver bandwidth optimization and traffic prioritization regardless of location. So that’s what the two have in common. From this point on, the two begin to separate from one another.
How SD-WAN and SASE Differ
Tip #1: The Endpoints are different
This is a case of macro vs. micro. SD-WAN is optimizing traffic between locations on the existing corporate network. Whether the WAN is leased from a provider or the organization owns its WAN infrastructure, SD-WAN appliances route the traditional hub and speak network topology traffic. On the other hand, SASE can service areas beyond the boundaries of a fixed corporate network. Rather than connecting branches to a central network, SASE is about uniting individual endpoints. An endpoint can be a branch office location, a remote workspace, a single device, or an individual user. Â
Tip #2: SASE is cloud-centric
Sometimes it’s easy to forget that there was a time when we weren’t dependent on the cloud. While SD-WAN can accommodate cloud computing, it is not a cloud-centric solution. SD-WAN was designed first and foremost for the traditional enterprise network that still backhauls most traffic back to the data center. A cloud gateway is required for each site that needs its users to connect directly to the internet for a designated workload type. SASE, however, is a cloud-native model, making it ideal for organizations that utilize SaaS and public cloud resources. SASE is a cloud service that uses points of presence (PoP) located close to the connecting device. The SASE vendor can provide these or from a public cloud provider. Â
See More: Tap Into the True Power of SASE With SD-WAN
Tip #3: The role of security
Security is not natively present within SD-WAN. Security integration requires the addition of third-party security and networking appliances such as secure web gateways and application firewalls. On the other hand, security is part of the core functionality of SASE. In fact, according to Gartner’s original definition of SASE back in 2019, SASE combines SD-WAN network controls with the following security control functions:
- Secure Web Gateway (SWG)
- Cloud access security brokers (CASB)
- Zero trust network architecture (ZTNA)
- Firewall as a service (FWaaS)
Since then, SASE solutions have integrated additional security functionality such as managed detection and response (MDR), data loss prevention (DLPW), sandboxing and advanced malware filtering. These are offered with the cloud service to enforce a security first network. With SASE, security and networking are fused together. Â
Tip #4: Packet treatment
The security offerings that SASE delivers are due to its ability to perform packet inspections. SD-WAN inspects the contents of a packet only enough to know where to route it. Once the first packet of a workload is identified, the SD-WAN appliance routes the traffic to its designated route. To accommodate deep-level packet inspection, traffic must be forwarded to a centralized traffic inspector such as the perimeter firewall unless additional firewalls have been deployed for each site location. A SASE solution gives visibility into your traffic by performing deep packet inspection (DPI). This inspection takes place at the location of the endpoint. Â
Tip #5: Multi Vendor/single vendor
SD-WAN does an excellent job at optimizing traffic across hardware infrastructure. The problem is that if you want to expand its capabilities, you need to turn to third-party solutions. This adds complexity and sometimes added latency, which can diminish the returns that SD-WAN is designed to deliver. SASE packages everything into a single vendor solution in which network routing policies coexist with security policies. This often reduces costs and simplifies management as admins no longer must swivel between multiple admin consoles.
Conclusion
SD-WAN remains a viable solution for any enterprise-scale organization utilizing a structured network such as a public school system. Organizations that infuse remote workspaces to accommodate remote work strategies or hybrid work models may need more. While some enterprises that have existing SD-WAN architectures may be transitioning to SASE soon, SD-WAN is not a prerequisite for SASE. GartnerOpens a new window expects that 40 percent of enterprises will have explicit strategies to adapt SASE solutions, up from only 1 percent at the end of 2018. By 2025 they expect that number to be eclipsing 60 percent. The dramatic growth is an example of how the world has changed so much in the past three years due to new work paradigms and the great threat environment that we all operate in today. In the end, it’s not really a matter of SD-WAN vs. SASE. It is simply which solution approach is a better fit for your needs.
Which of these technologies would you recommend to your organization’s decision-makers? Let us know on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We’d love to hear from you!Â