What MPLS is
MPLS is a private network your carrier builds between your offices. Traffic never touches the public internet, the carrier manages the routing, and you get a service-level agreement on uptime and latency. It was the default for connecting offices for two decades.
The downsides: it costs far more per megabit than business internet, new circuits can take weeks or months to install, and every change goes through the carrier. Cloud apps are also awkward, because traffic to Microsoft 365 or other cloud services often has to travel back to a central site before it reaches the internet.
What SD-WAN is
SD-WAN builds encrypted connections between your offices over ordinary internet lines: fiber, cable, fixed wireless or 5G. A device at each site, such as a FortiGate or Meraki MX, watches every line and steers each application over the best path in real time. If one line degrades, voice and video move to the other.
Side by side
| MPLS | SD-WAN | |
|---|---|---|
| Cost per megabit | High | Low (uses business internet) |
| Install time | Weeks to months for new circuits | As fast as the internet lines can be installed |
| Reliability | Carrier SLA on one private circuit | Two or more lines with automatic failover |
| Cloud apps | Often backhauled through a central site | Direct to the internet from each office |
| Changes | Carrier ticket | Your own dashboard or firewall |
| Security | Private, but not encrypted by default | Encrypted tunnels; security depends on configuration |
When to keep MPLS
- A contract still has years to run and the exit fees outweigh the savings.
- An application or regulator needs a carrier-guaranteed private circuit.
- You're in a location with only one poor internet option.
When SD-WAN wins
- Most of your apps are in the cloud.
- You want two internet lines per office instead of one expensive circuit.
- You open, move or close offices often and can't wait months for circuits.
The common middle ground
Many businesses run both for a while: MPLS stays as one path, a business internet line is added as the second, and SD-WAN manages both. When the MPLS contract ends, it's either renewed or replaced with a second internet line. In NYC buildings, it's worth checking which providers already have fiber in the building before you choose, because that drives both cost and install time.
For the security side of connecting offices, see IPsec VPN vs MPLS, and for where SD-WAN is heading, SD-WAN, SASE and SSE explained.
