What is SASE, SD-WAN, and SD-Branch?

Trying to figure out what is really the difference between SASE, SD-WAN, and SD-Branch? Rest assured you are not alone. Before we untangle the difference between these concepts, it’s important to first clarify what they have in common. All three of these technology concepts are related to secure edge networking and addressing the challenge of managing a secure, agile, and resilient network of geographically distributed locations while reducing the related IT cost, time, and complexity involved. At first glance, there seems to be quite a bit of redundancy in these three concepts, but when you take a closer look, there are some clear differences.

So, this is Netsurion’s effort to help you better understand these concepts to help you make a better choice in secure edge networking solutions for your business.

SD-WAN

Let’s start with SD-WAN, software-defined wide area networking. SD-WAN is an application of software-defined networking (SDN) focused on connecting branch office networks to a central data center or headquarters network. SD-WAN architecture consists of three primary components: 

1. Edge Device: Customer-premise equipment (CPE) that connects the individual branch location
2. Service Gateway: Virtualized network manager and SD-WAN control plane
3. Cloud Orchestrator: Single pane of glass to deploy, monitor, and manage network services

The promise of SD-WAN as a virtualized network overlay is: 

• The opportunity for increased bandwidth at lower cost by virtue of selecting the optimal circuit and ISP for each branch location
• Reduced need for on-site IT staff to deploy and manage the network by virtue of a cloud management console
• Full visibility and control over the entire network and each individual branch location

When it comes to selecting an SD-WAN provider, it is important to note that there are SD-WAN-as-a-Service providers and Managed SD-WAN providers. The difference is that the former provides the tools, architecture, and promises to “keep the lights on” while the latter provides all of this plus staff to actually drive the orchestrator – to provide hands-on management of your network and security policies. 

SASE

Secure access service edge (SASE) is a relatively newer term and shares many of the same advantages and use cases of SD-WAN, but differs in approach. While SD-WAN is primarily architected to connect disparate branch networks to a private network typically represented by a data center or corporate headquarters, SASE is architected instead to connect branch locations to the cloud. More specifically, and where the name is derived, SASE connects these branches to the service edge which consists of distributed points of presence (PoPs). Also, while SD-WAN certainly enables security, it doesn’t by default include security. SASE solutions, hence, the inclusion of “secure access” in the name, are expected to have embedded security controls. 

For the most part, SD-WAN and SASE are two means to the same end. Which means is best for you depends on your business needs.

SD-Branch 

Software-defined branch networking (SD-Branch) is a little different than the others because it is not a technology architecture. Rather, SD-Branch is a business application concept. SD-Branch is an extension of software-defined networking (SDN) technology to more holistically meet the needs of environments such as retail stores, restaurants, hotels, and branch locations where traditional SD-WAN solutions don’t fit or most SASE solutions are incomplete. Most competitive solutions are not right-sized and right-priced for multi-location businesses with small footprint Point-of-Sale (POS) environments and are complex to manage. SD-Branch combines routing, security, Wi-Fi, cellular failover, and even accounts for PCI DSS into one business-optimized solution. 

Secure Edge Networking 

So, what does it all mean? It all comes down to providing secure edge networking. SD-WAN and SASE are two different approaches to optimize network management and security for geographically distributed enterprises. SD-Branch is somewhat of a “branch network in a box” solution purpose-built for small branch offices that bundles in the primary network functions businesses likely require and addresses advanced cybersecurity, agile management, resilient connectivity, and regulatory compliance.