How to Choose an SD-WAN Router

SD-WAN: Why Replace (or Complement) MPLS

SD-WAN (Software-Defined WAN) virtualizes WAN transport by aggregating multiple links (Internet fiber, MPLS, 4G/5G) into a secure overlay. The SD-WAN appliance at each site applies intelligent application-aware policies: Office 365 uses the best available Internet link, the mission-critical ERP remains on MPLS, and backups run over the Internet during off-peak hours. All this is supported by continuous SLA monitoring (latency, jitter, packet loss) and automatic failover in the event of service degradation.

In 2026, 60% of multi-site businesses have an active SD-WAN project (vs 15% in 2022). The main driver is no longer limited to WAN cost savings—it now includes cloud integration (Office 365, AWS, Azure), the need for SASE (distributed security), and faster deployment of new sites (1 week vs 3 months for MPLS).

The Three Leading SD-WAN Platforms

Cisco SD-WAN (Viptela) on Catalyst 8000

Cisco acquired Viptela in 2017 to build its enterprise SD-WAN solution. The architecture is based on 4 components: vManage (orchestration UI), vBond (zero-touch provisioning), vSmart (OMP control plane), and cEdge (data plane on Catalyst 8000 and ISR 4000). The control plane uses the proprietary OMP (Overlay Management Protocol).

• Catalyst 8200 (C8200-1N-4T): entry-level branch platform, 250 Mbps SD-WAN. For small branch offices. OPTINOC price: ~€3,000 excl. VAT.
• Catalyst 8300 (C8300-2N2S-6T): enterprise branch platform, 2.5 Gbps SD-WAN. For medium-sized branch offices. Price: ~€6,000 excl. VAT.
• Catalyst 8500 (C8500-12X): data center/hub platform, 10+ Gbps. Price: ~€18,000 excl. VAT.
• Licensing: Network Essentials (NE), Network Advantage (NA), or Network Premier (NP). Budget €100-400/site/year depending on the tier.
• Strengths: mature vManage orchestration (1000+ sites), Cloud OnRamp for SaaS/IaaS, and the Cisco ecosystem.
• Weaknesses: deployment complexity (4 components), high licensing costs, and no integrated NGFW (separate Umbrella/Firepower required).

Fortinet Secure SD-WAN on FortiGate

Fortinet integrates SD-WAN directly into FortiOS—the same OS as the NGFW. A FortiGate natively provides firewall + SD-WAN + IPS + VPN capabilities, without a separate component. FortiManager provides orchestration, while FortiAnalyzer handles logging/analytics. This is the most integrated approach on the market.

• FortiGate 60F (FG-60F): SMB branch platform, 700 Mbps Threat + SD-WAN. OPTINOC price: ~€700 excl. VAT.
• FortiGate 100F (FG-100F): enterprise branch platform, 1 Gbps Threat + SD-WAN. Price: ~€2,800 excl. VAT.
• FortiGate 200F (FG-200F): hub/data center platform, 3 Gbps Threat + SD-WAN. Price: ~€5,500 excl. VAT.
• SD-WAN is included natively in FortiOS—with NO additional license required. This is a major cost advantage.
• Strengths: integrated SD-WAN + NGFW (no service chaining), unbeatable price/performance ratio, easy-to-deploy FortiManager, and ZTP through FortiCloud.
• Weaknesses: no multi-vendor orchestration, and NSE skills are less widespread than CCNP SP skills.

Juniper SRX + Session Smart Router (SVR)

Juniper combines SRX (Junos firewall) with SVR (Session Smart Router, formerly 128 Technology, acquired in 2020). SVR offers a unique approach: session-aware routing (with no overlay tunnel). Each application session is routed individually according to link quality, without IPsec/GRE encapsulation—saving 30% of bandwidth compared with tunnel-based SD-WAN solutions.

• SRX380: branch platform with integrated SVR SD-WAN. OPTINOC price: ~€4,000 excl. VAT.
• SRX1500: data center/hub platform. Price: ~€8,000 excl. VAT.
• Mist AI: unified cloud-managed operations (Wi-Fi + wired + SD-WAN).
• Strengths: unique session-aware routing (no tunnels), Junos integration (advanced BGP/OSPF), and the Mist AI cloud.
• Weaknesses: limited market share (scarce expertise), and SVR is still relatively new (growing adoption but not yet mainstream).

Multi-Site TCO Comparison (50 Sites)

Scenario: 50 sites (40 small + 8 medium-sized + 2 DC hubs), dual-WAN Internet fiber at each site, with NGFW security enabled:

• Fortinet: 40× FG-60F (€28K) + 8× FG-100F (€22K) + 2× FG-200F (€11K) + FortiManager VM (€5K) + 3-year UTP licenses (€45K) = ~€111K excl. VAT.
• Cisco Viptela: 40× C8200 (€120K) + 8× C8300 (€48K) + 2× C8500 (€36K) + vManage/vBond/vSmart (€25K) + 3-year NA licenses (€90K) + separate Umbrella/Firepower (€50K) = ~€369K excl. VAT.
• Juniper SVR: 40× SRX380 (€160K) + 8× SRX1500 (€64K) + 2× SRX4100 (€70K) + Mist (€30K) + 3-year licenses (€40K) = ~€364K excl. VAT.

In this scenario, Fortinet costs 30% as much as Cisco Viptela. The difference represents savings of €258K. For very large deployments (500+ sites), Cisco vManage provides more mature orchestration, although FortiManager also scales to 500+ sites.

Integrated Security vs SASE

SD-WAN alone is not enough—local Internet traffic (DIA, Direct Internet Access) and cloud access must also be secured. There are two approaches:

• Integrated security (Fortinet, Juniper SRX): the NGFW is integrated into the SD-WAN appliance. Each site has its own local NGFW. This approach is straightforward and cost-effective, but each site must be managed.
• Cloud SASE (Cisco Umbrella, Palo Alto Prisma, Zscaler): security is delivered from the cloud (SWG, CASB, ZTNA, FWaaS). SD-WAN sends Internet traffic to cloud POPs for inspection. This is more scalable but adds latency and recurring costs.
• Hybrid (recommended): local NGFW for LAN traffic + cloud SASE for remote users and direct SaaS traffic.

Sizing by Site Size

• Very small branch (5-20 users): FortiGate 40F or Catalyst 8200. 1 fiber link + 1 4G failover link.
• Standard branch (20-100 users): FortiGate 100F or Catalyst 8300. 2 Internet fiber links from 2 different service providers.
• Medium-sized site (100-300 users): FortiGate 200F or Catalyst 8300. 1Gbps fiber + MPLS + 4G failover.
• Data center hub: FortiGate 600F or Catalyst 8500. Aggregates tunnels from all sites. Allow for 10× the bandwidth of a medium-sized site.

Our OPTINOC Recommendation

For 80% of multi-site SD-WAN projects: Fortinet Secure SD-WAN. Integrated SD-WAN + NGFW with no additional license, FortiManager for orchestration, and a TCO 3× lower than Cisco make this solution unbeatable. For very large enterprises (500+ sites) with a Cisco ecosystem and an OpEx budget, Cisco SD-WAN on Catalyst 8000 remains the benchmark for orchestration.

OPTINOC supplies FortiGate, Cisco Catalyst 8000, and Juniper SRX products with manufacturer warranties. Request a comparative TCO assessment tailored to your multi-site environment.