SASE vs. SD-WAN

Organizations connect users and locations to the internet, cloud applications, and the internal network by means of a wide area network (WAN), which consists of multiple local area networks connected together. Initially, this was done via Multiprotocol Label Switching (MPLS), which is a technology that directs traffic across a private network via the shortest available path by using labels rather than addresses. In today’s digitally driven world that is adopting cloud technologies and is undergoing constant digital transformation, MPLS no longer cuts it. It is relatively expensive, has limited bandwidth, and is limited by location. 

SD-WAN has been widely used for more than a decade, but there is a newer technology emerging called Secure Access Service Edge (SASE, pronounced “sassy”). It does the same thing as SD-WAN, but its focus is on making the connections more secure. 

How do SD-WAN and SASE work, and what are the advantages and disadvantages of each technology? When comparing SD-WAN vs SASE, which technology should your organization use now and moving forward?

SD-WAN is a technology where software is used to control connectivity across a network. It provides centralized control to govern how nodes, such as remote users, edge devices, branch locations, IoT devices, and so forth, connect to an organization’s system. Its purpose is to optimize traffic in a network, increase bandwidth efficiency, and lower costs. 

SD-WAN works this way: it links all remote users and locations, no matter where they are, back to the organization’s central secure network rather than directly to the internet. To do that, SD-WAN can use new network infrastructure, but it can also leverage existing infrastructure, such as MPLS and LTE, aggregating available technologies to provide the most optimal paths to connectivity. It uses software to centralize control of traffic, encrypting it and using solutions, such as application-aware routing, organizational policies, and dynamic link assessment, to direct and optimize traffic to IaaS and SaaS. When an SD-WAN router receives a connection request, it intelligently decides how to route it based on the following criteria:

1. The needs of the application
2. The priorities defined by organizational policies
3. The availability and health of network links

Consider the advantages and disadvantages of SD-WAN solutions:

Pros

1. SD-WAN provides centralized control and automation
2. SD-WAN meets cloud migration needs
3. SD-WAN is almost 50% less expensive than traditional WAN technologies
4. SD-WAN provides efficiency and reduces latency in broadband use
5. SD-WAN simplifies infrastructure for rapid deployment at scale
6. SD-WAN provides reliable connections by leveraging existing connections

Cons

1. SD-WAN lacks certain security features, meaning a data breach at one location is a threat to the entire network
2. SD-WAN solutions may not support WAN routers
3. SD-WAN has to be designed and configured properly or else errors and packet loss may result
4. SD-WAN devices require regular firmware updates 

SASE is a newer technology launched in 2019. The name was coined by Gartner and accomplishes the same thing as SD-WAN but adds additional layers of security. It addresses the limitations of SD-WAN and takes into consideration the rapidly evolving security needs of organizations in an environment of digital transformation and cloud computing.

SASE links all endpoints to the edge of an organization’s network, which is where it connects with the rest of the internet. SASE combines the software-driven network optimization of SD-WAN with network security functions. Security is provided as a cloud service, using technologies such as Cloud Access Security Broker (CASB), Firewall as a Service (FWaaS), and Secure Web Gateway (SWG). Instead of forwarding traffic to a control center for inspection and verification, SASE has points of presence (PoPs) or enforcement points throughout the network, so traffic can be sent to the nearest point, distributing the workload. When SASE receives a traffic request, it decides on routing based on:

1. The identity making the request
2. The context of the request, such as device health and behavior and the sensitivity of the data being accessed
3. The pertinent security and compliance policies
4. The risk assessment conducted during the session 

Consider the advantages and disadvantages of SASE solutions:

Pros

1. SASE is a single service, resulting in savings and efficiency
2. SASE distributes the workload through enforcement points rather than from a control center
3. SASE solutions are designed for virtual connections and can replace VPNs
4. SASE does not need agent software, making it easier and less expensive to deploy to branch locations
5. SASE makes managing connectivity and security simultaneously much simpler
6. SASE is a good choice for networks that leverage edge computing and IoT devices

Cons

1. SASE may not be suited to organizations relying heavily on legacy connections such as MPLS
2. SASE is still in the early stages of development
3. SASE may result in duplications and inefficiencies if an organization has already implemented SD-WAN
4. SASE implementation may require heavy investment in personnel training and retooling

While SASE and SD-WAN are different, choosing one over the other is not necessarily easy. For many organizations, it may not be a question of SD-WAN vs SASE, but rather, SD-WAN and SASE in coordination. 

SASE can be leveraged as a standalone solution if the organization has: 

1. No remote or hybrid workers
2. An adequate MPLS infrastructure already in place 
3. Not already implemented SD-WAN

These criteria are pretty specific, and after the pandemic, there are few organizations not leveraging remote workers. So in most situations, any organization that would like to implement SASE would likely be doing so on top of SD-WAN. In effect, SD-WAN becomes the foundation for SASE, and SASE provides layers of security and efficiency to make up for what SD-WAN lacks.

The answer in short? Possibly. In the meantime, they will likely exist in parallel and complement each other. But why might SASE eventually replace SD-WAN? Legacy network architecture orbited around a central data center, and although SD-WAN improved network connectivity and efficiency by using virtual overlays, the architecture stayed pretty much the same.

But with the emergence and evolution of new technologies, such as cloud services, digital transformation, edge computing, and the Internet of Things (IoT), backhauling all traffic to a central data center is becoming inefficient and often unnecessary. SASE’s approach of providing secure connections on the service edge and verifying and directing traffic from PoPs solves the problem of inefficiency while bolstering security.