In this article
SD-WAN is a managed business network in which every site — shop, restaurant or office — has two or more internet connections and a device that chooses, moment by moment, the best one for each application, following rules set in a central dashboard. It pays off when an operator outage at one site costs sales or brings the team to a halt, which typically happens from three sites upwards, with centralised billing or cloud applications. For two offices that depend little on each other, a well-configured VPN is still enough.
How it works, without the jargon
The WAN is the network that links a company's sites to one another. SD stands for software-defined: rules are written once in a central dashboard and pushed to every site, instead of configuring each device by hand. Think of a satnav that spots traffic on the motorway and diverts you onto the A-road without stopping the car.
At each site, the SD-WAN device:
- Combines connections Fibre, a second fibre from another operator or mobile data, all at once.
- Routes by application Billing and voice over the most stable link; software updates over the other.
- Fails over on its own When a connection drops or degrades, with nobody needing to act on site.
- Encrypts and protects Traffic between sites is encrypted and every site follows the same security rules.
In practice, the message changes from “the Braga shop has no system” to “the Braga shop switched connection and nobody noticed”.
Site-to-site VPN or SD-WAN?
A site-to-site VPN is an encrypted tunnel between two locations, usually over a single connection at each end. It is economical, it works and it remains the right answer in many cases. SD-WAN adds intelligence and central management on top.
| Criterion | Site-to-site VPN | SD-WAN |
|---|---|---|
| Sites | Two or three, stable | Three or more, or frequent openings |
| Internet outage at one site | The tunnel stays down until someone acts, unless redundancy has been configured | Automatic failover to the other connection |
| Critical applications | Limited prioritisation | Billing, voice and cloud with defined priority |
| Management | Site by site | Central dashboard with shared templates |
| New site | Configured by hand | The existing template is applied |
| Visibility | Only when someone complains | Real-time status of every connection |
Rule of thumb: if one hour without internet at a shop costs more than that shop's equipment and second connection for a year, SD-WAN pays for itself. To work out that figure, use the real cost of an hour of downtime.
Redundancy is what gives SD-WAN its purpose
With a single connection, the device has nothing to choose from. Three rules for genuine redundancy:
- Different operators — two fibre lines from the same operator can fail at the same time.
- Different physical routes — if both come in through the same duct, roadworks outside cut both; a mobile or satellite link removes that common point.
- Guaranteed power — without a UPS, a power cut switches everything off. See how to prepare your business for a blackout.
Connection options and what to ask your operator for are covered in the guide to business internet with redundancy.
The same security at every site
Connecting sites also means that a problem at one can reach the others. An SD-WAN project should bring segmentation — tills, office, cameras and guest Wi-Fi on separate networks — and the same firewall policy across the whole network. The topic is covered in depth in central firewall for multiple shops and offices.
Many recent firewalls already include SD-WAN features. On many networks, the most economical option is to enable and configure what is already there, rather than buying a new device for every site.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Real multi-site networks managed by DataRoad
Fullest — 16 restaurants in a single dashboard
Fullest, a group with 16 restaurants in Lisbon and Porto — among them Adega de São Roque, Bacalhau com Todos and Peixaria do Rossio — handed its network infrastructure to DataRoad. The project brought together firewall and security, business Wi-Fi, centralised cloud management with the same configuration across every restaurant, separate networks for staff and guests, and real-time remote monitoring of usage, signal and security settings.
Boost Portugal — redundancy across four destinations
Boost Portugal, a tourism and leisure group operating in Lisbon, Porto, the Douro and Madrid, has redundant internet with automatic failover and link aggregation in its contract with DataRoad, alongside remote monitoring with alerts and availability reports.
In both cases, the rule is the same: no site depends on whoever happens to be there to stay connected and protected.
Phased roll-out, without stopping operations
- Survey — connections, operators, equipment, critical applications and the cost of downtime at each site.
- Design — a second connection per site, priorities per application and common security rules.
- Pilot — one site, with billing, voice and cloud validated, including a deliberate cut of the main connection.
- Expansion — site by site, outside peak hours.
- Monitoring — degradation alerts before an outage and availability reports per site.
Frequently asked questions
Does SD-WAN replace the VPN?
Between sites, yes: it creates the encrypted tunnels and adds automatic connection selection and central management. For remote workers the answer is different, as explained in why a VPN is no longer enough for remote access.
Does every site need two connections?
To get the most from SD-WAN, yes — at least wherever downtime costs sales or productivity, ideally with different operators and routes, such as fibre and mobile.
Does all the equipment need replacing?
Not always. Many current firewalls already support SD-WAN. The survey comes first, and only equipment that cannot be centrally managed or no longer receives updates is replaced.
How long does the roll-out take?
It depends on the number of sites and on how long the operators take to install the second connections. It starts with a pilot and moves forward in phases, without stopping operations.
A connection map of all your sites in 10 working days
DataRoad maps the connections, equipment and critical applications of every shop or office, calculates the risk of downtime and delivers the SD-WAN and redundancy design for each site. Management of managed firewalls and network security is included in the IT Unlimited Premium plans, with on-site support.
More than 10 workstations · support contract · remote, on-site and telephone support. Request a no-obligation proposal.
