SD-WAN and SASE both build on traditional network models, such as those used to connect a company’s offices. While the two models share some features and advantages, they have different structures and approaches. In the simplest terms, an SD-WAN inspects and routes data more efficiently, while a SASE combines networking and security functions into a single service. Here’s what you need to know.
A wide area network connects devices in multiple locations, usually meaning some data goes over the Internet rather than solely through dedicated cabling. The network usually routes data between any two points through a specific device to allow analysis, filtering, and security checks. This process, called backhauling, can slow performance.
An SD-WAN breaks the link between the security/control process and the network’s physical hardware. Inspecting the data in the cloud allows more efficient routing.
Key characteristics of an SD-WAN include:
At first glance, SASE may appear similar to SD-WAN, but it is a different concept and architecture. It rethinks the design of a network to eliminate the need for a central inspection and filtering point. In other words, there’s no backhauling.
A SASE setup treats every user device as being at the network’s edge (hence the “service edge”). SASE works by viewing these as endpoints rather than as devices. The data inspection occurs at these “Points of Presence,” meaning the data can be routed here as efficiently as possible.
SASE can also carry out parallel traffic inspection, meaning multiple filters or checks are carried out simultaneously and then combine the results to determine the next steps. That contrasts with SD-WAN, which chains together individual inspection elements in series, requiring more time.
In effect, SASE combines networking and security into a single service.
Key characteristics of SASE include:
Exactly how to describe the relationship between SASE and SD-WAN depends on your perspective. For example, some people see it as an evolution, with SASE being SD-WAN plus “security as a service.” Others consider it a complete rethinking, with SD-WAN being just one component in the overall SASE package.
Perhaps the easiest way to think of it is like this:
Consider this analogy: in place of data inspection on a computer network, imagine if the US Postal Service (USPS) had to inspect every parcel. They would have to check the address, check the size and weight, or check for illegal or dangerous contents.
A traditional WAN model would mean every package, no matter its origin or destination, had to go to the USPS headquarters in Washington, DC, for inspection. This would greatly slow down deliveries, even if the sender and recipient were close to one another.
Switching from WAN to SD-WAN would mean the USPS could now inspect the packages at any post office or even in trucks that could go anywhere. This would speed up deliveries by allowing more efficient routing while inspecting every package.
In both cases, the analogy works by likening individual devices to cities across the US. This analogy doesn’t translate to the SASE model. Instead, imagine the network as the US and every device as a border city in Canada or Mexico. The network inspects data like the local immigration and customs checkpoints on either side of the border. People and vehicles are inspected at the point they enter or leave the country in the same way that SASE inspects data at the very edge of the network.
While every business is different, some use cases are more suited to one technology over the other. For example:
What’s the next step?
If you’re still uncertain whether SD-WAN or SASE is best for your needs, or if you want more advice on making the transition, we’ll be happy to help. Contact us today.
Blogs
See only what you need, right when you need it. Immediate actionable alerts with our dynamic topology and out-of-the-box AIOps capabilities.
