The wide area network: MPLS, SD-WAN and SASE
Lesson 2 of 5
2The wide area network: MPLS, SD-WAN and SASE
The big pictureA company with a hundred branches, two data centres and apps in three clouds. For decades the answer was private MPLS lines from the provider: costly but steady. Then the internet became fast and cheap, and apps moved to the cloud instead of the data centre. A senior engineer decides where the internet is enough, where a private line is needed, and how to protect a branch that no longer sits behind the head office firewall.
What the picture shows: The SD-WAN box in the branch measures every link every few seconds, sends each app down the link that meets its SLA, and switches the moment it degrades.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
MPLS is like a private train line the company rents: precise timetables and nobody crowds you, but costly and months to install. SD-WAN is like a maps app that knows every road available (the internet, mobile, and the train line if any), picks the fastest for each trip right now, and reroutes if traffic builds. SASE moves the security checkpoint from the head office gate to stations spread near every employee, wherever they are.
MPLS (RFC 3031): on entering the provider network a packet gets a 20-bit label inside a 32-bit header (label 20, TC three, bottom-of-stack one, TTL eight), and the middle routers (LSRs) swap labels without an IP table lookup. L3VPN (RFC 4364): each customer gets a VRF (a separate routing table), an RD makes overlapping addresses unique, an RT decides who imports which routes, and MP-BGP carries them. SD-WAN: encrypted tunnels (usually IPsec) over every link, a central controller pushing policies, live measurement of latency, jitter and loss on every tunnel, application-aware path selection against an SLA, and zero-touch provisioning (ZTP): the box arrives at the branch and pulls its own config. SASE (Gartner's term from 2019) = SD-WAN + SSE, and SSE bundles SWG (web proxy), CASB (cloud app control), ZTNA (Zero Trust access) and FWaaS (firewall as a service).
Before You Start
🌐BGP
You know sessions and policies.
🚦Quality of service
You know latency, jitter and loss.
The Core Idea
1MPLS: labels and VRFs
MPLS was first about speed: instead of every router searching for the longest match in a huge table, it reads a short label and swaps it. What providers sell today is separation: one network serves a thousand companies, each with its own VRF as if it had a network to itself, even when two companies use the same 10.0.0.0/8 addresses.
Just four bytes between the Ethernet and IP headers. In an L3VPN you see two stacked labels: one for the tunnel and one for the VRF.
def mpls_header(label, tc=0, bottom=True, ttl=64):
word = (label << 12) | (tc << 9) | (int(bottom) << 8) | ttl
return f"{word:032b}"
h = mpls_header(label=16003, tc=5, bottom=True, ttl=63)
print("label ", h[:20], "=", int(h[:20], 2))
print("TC ", h[20:23], "=", int(h[20:23], 2), "(QoS class)")
print("S ", h[23], " (bottom of stack)")
print("TTL ", h[24:], "=", int(h[24:], 2))
print("labels possible:", f"{2 ** 20:,}")2SD-WAN: every link together, a decision per app
The SD-WAN box in a branch builds an encrypted tunnel over every available link and measures it constantly. Each app has an SLA: voice wants latency under 150 ms and loss under 1%, backups do not care. The central controller writes the policy once and every branch applies it. When the fixed internet fails, voice moves to mobile within a second.
The cheapest link meeting the SLA wins. When the fibre degrades, voice moves to MPLS, ERP to 5G as the cheapest link still meeting its SLA, and backups stay on the cheapest.
links = { # live measurements on each tunnel
"MPLS": {"latency": 38, "jitter": 2, "loss": 0.0, "cost": 10},
"Fibre ISP": {"latency": 24, "jitter": 9, "loss": 0.4, "cost": 2},
"5G": {"latency": 45, "jitter": 22, "loss": 1.8, "cost": 6},
}
SLA = {"voice": {"latency": 150, "jitter": 30, "loss": 1.0},
"erp": {"latency": 250, "jitter": 100, "loss": 2.0},
"backup": None}
def path_for(app):
rule = SLA[app]
ok = [n for n, m in links.items() if rule is None or all(m[k] <= rule[k] for k in rule)]
return min(ok, key=lambda n: links[n]["cost"]) if ok else "best effort on " + min(links, key=lambda n: links[n]["loss"])
for app in SLA:
print(f"{app:<7} -> {path_for(app)}")
links["Fibre ISP"]["loss"] = 3.5 # the fibre starts dropping packets
print("fibre degrades:")
for app in SLA:
print(f"{app:<7} -> {path_for(app)}")3SASE: protection moves to the cloud
In the past all branch traffic went back to head office to pass the firewall before going out to the internet (backhaul), delaying cloud apps. SASE combines the network (SD-WAN) and security (SSE) in a cloud service with points of presence near users: an employee in a branch or at home goes through the nearest point, gets inspected, and then goes straight to the app.
| SSE part | What it does | Replaces |
|---|---|---|
| SWG | A web proxy that inspects browsing and blocks the malicious | A proxy at head office |
| CASB | Sees and limits use of cloud apps and the data in them | — |
| ZTNA | Access to one app after checking identity and device | A VPN opening the whole network |
| FWaaS | A firewall in the cloud for every site | A firewall in every branch |
Worked example
The task: a retail chain with 80 branches on 20 Mbps MPLS each; the bill is large, the apps moved to the cloud, and users complain Microsoft 365 is slow. Propose a plan.
The answer: SD-WAN in every branch over a 200 Mbps fibre link with a 5G backup. Keep MPLS only in the warehouses and the two data centres for the critical stock system. The policy: point of sale and voice on the best link meeting the SLA, Microsoft 365 breaks out directly from the branch to the nearest SASE point instead of going back to head office, and guests over the local internet only. Start with five pilot branches, measure latency to Microsoft 365 before and after, then roll out in batches. Zero-touch provisioning means shop staff just plug the box in.
Myth vs Reality
| Myth | Reality |
|---|---|
| MPLS is encrypted because it is private. | MPLS separates; it does not encrypt. Data crosses the provider in clear text unless you encrypt it. |
| SD-WAN means dropping MPLS entirely. | SD-WAN uses MPLS as one of its links if you need it. The decision is per site. |
| SASE is a product you buy from one company. | SASE is a design model; it may come from one vendor or two that integrate. |
Where you meet it at work
🛒Retail chains
SD-WAN with zero-touch provisioning to open a new branch in a day.
🏦Banks
MPLS for critical systems, SD-WAN for the rest, and VRF separation between services.
🏠Remote work
SASE protects the employee at home as it does in the office.
Test your understanding
How many bits is an MPLS label?
The label is 20 bits inside a 32-bit header.
What lets two companies use the same addresses on one MPLS network?
Each VRF is a separate routing table, and the RD makes addresses unique in BGP.
How does SD-WAN decide a call's path?
It measures latency, jitter and loss and picks the fitting link right now.
Which SSE part grants access to one app instead of the whole network?
ZTNA checks identity and device and opens one app only.
What is the problem with backhaul in the cloud era?
The long road slows SaaS apps and loads the head office link.
Quick review cards
Check Your Understanding
Why do some companies still pay for MPLS despite SD-WAN?
Because its quality is guaranteed by contract, and very critical systems need that guarantee.
What is the difference between separation and encryption on a WAN?
Separation stops customers mixing; encryption stops data being read. MPLS only separates.
An employee at home needs one internal app. VPN or ZTNA?
ZTNA: it opens that app alone after checks, instead of putting the device inside the whole network.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.