Picture two offices that need to act like one: shared files, a phone system, a line-of-business application in the main office. There are two classic ways to join them. You can rent a private path from a carrier (MPLS), or you can build encrypted tunnels across the internet (IPsec VPN). Here's how they really differ, and how the answer has shifted as work moved to the cloud.
How each one works
MPLS (multiprotocol label switching) is a carrier service. Your traffic travels across the provider's private network along predetermined paths instead of being routed hop by hop like normal internet traffic. Because the paths are fixed and the network is private, carriers can offer predictable performance and prioritize traffic such as voice.
IPsec is a set of protocols that adds encryption and authentication to traffic. An IPsec VPN builds an encrypted tunnel between the firewalls at each office, using each office's ordinary internet connection. Anyone in between sees only scrambled data.
Side by side
| MPLS | IPsec VPN | |
|---|---|---|
| Transport | Carrier's private network | Your existing internet lines |
| Encryption | Not by default; privacy comes from the private network | Every packet encrypted |
| Performance | Predictable, with traffic prioritization from the carrier | As good as each office's internet line, with no end-to-end guarantee |
| Cost | Usually higher; dedicated carrier service | Usually lower; uses internet you already pay for |
| New sites | Ordered and provisioned by the carrier | A firewall and an internet line |
| Cloud apps | Cloud traffic often travels back through a central site first | Offices can reach the cloud directly |
Security: private is not the same as encrypted
MPLS traffic stays on the carrier's network, which is why it has long been considered private. But it isn't encrypted by default, so anyone with access to that path could read it. IPsec encrypts everything, so the traffic stays private even though it crosses the public internet. If your data is sensitive, encrypting traffic end to end is worth doing either way; some businesses even run IPsec over their MPLS for that reason.
Performance: guarantees vs. good enough
MPLS's strength is predictability: the carrier controls the whole path and can prioritize voice and video. An IPsec tunnel rides the internet, so performance depends on each office's line and on conditions in between. For most small and mid-sized businesses with solid business internet, that is more than good enough, and it is where SD-WAN comes in.
Where SD-WAN fits
SD-WAN sits on top of your connections and manages them together. It can build IPsec tunnels over two internet lines at each office, measure them constantly, and steer calls and video onto whichever link is performing best, falling back automatically if one fails. It can also manage an existing MPLS circuit alongside internet lines, which is how many businesses move away from MPLS gradually. (See Is SD-WAN dead? for where SD-WAN is heading.)
How we decide for a client
- Keep or choose MPLS when you have strict performance requirements between sites, an application that is sensitive to delay, or a contract that still has value.
- Choose IPsec VPN when you have a few offices, good internet at each, and most of your applications are in the cloud.
- Add SD-WAN when calls and video matter, when you want two internet lines per office for failover, or when you're moving off MPLS in stages.
Whichever you choose, the firewall at each office matters as much as the link. Our Fortinet vs. Meraki comparison covers how two common choices handle site-to-site VPN.
Sources
Vendor details checked September 2026. Licensing and product features change; confirm current terms with the vendor before you buy.
