SD-WAN and SASESecure Networking

SD-WAN (software-defined wide area network) is a way of connecting your offices, data centres and cloud services using software to control how traffic moves across the network.

Traditional networks rely on fixed, often expensive connections between sites. SD-WAN can use any mix of connections, such as fibre, business broadband, 4G or 5G and existing leased lines, and it chooses the best route for each application in real time. If one connection slows down or fails, traffic moves to another automatically.

IT teams manage the whole network from one central platform, instead of configuring each site separately. The result is a faster, more reliable network that usually costs less to run.

SASE (secure access service edge, pronounced "sassy") combines networking and security into a single service delivered from the cloud.

It brings together SD-WAN for connectivity with a set of cloud-based security services. These include a secure web gateway that filters internet traffic, a cloud access security broker (CASB) that controls use of cloud applications, zero trust network access (ZTNA) that verifies every user and device before granting access, and firewall as a service (FWaaS).

Instead of sending traffic back to a central office to be checked, SASE applies security wherever users are, whether in a branch, at home or on the move. That suits businesses whose people and applications are no longer in one place.

There is no single price that makes sense for every organisation.

Cost depends on the number of sites, the bandwidth each site needs, the hardware at each location, the software licences and whether you want the network managed for you. Most providers charge per site per month, and some also charge an upfront cost for hardware. Adding SASE security services increases the cost, because you're also paying for cloud-based protection.

SD-WAN often reduces overall network costs, especially for businesses replacing expensive leased lines with business broadband. We would rather understand your sites and requirements first and quote for a clear scope than give you a headline price that changes later.

A managed SD-WAN or SASE service usually covers designing the network, supplying and installing the equipment at each site, and configuring routing, quality of service and security policies.

Once the network is live, the service includes continuous monitoring, troubleshooting, software updates, security policy management and coordination with your internet providers when a connection has problems. For SASE, it also includes managing user access rules and keeping the cloud security services up to date.

Good services also give you regular reports on network performance, application behaviour and security events, and they commit to service levels for availability and response. Check whether hardware, security features and ongoing support are included or priced separately.

Yes. Many businesses start with SD-WAN and add SASE security as their needs grow, and we design SD-WAN networks with that path in mind.

Because SD-WAN is the networking foundation of SASE, upgrading means adding cloud-based security services on top, such as web filtering, cloud application control, zero trust access and firewall as a service. Depending on your SD-WAN platform, you may be able to add these through the same vendor or connect a separate security service.

We assess your current setup, recommend the right upgrade path and roll out the security services in phases, so your network keeps running throughout.

Yes. Supporting people who work outside the office is one of the main reasons businesses choose SASE.

We apply security at the network edge, close to where your users are, so employees working from home or on the move get the same protection as people in the office. Every user and device is authenticated before it can connect, and access decisions follow zero-trust principles, based on who the user is, the health of their device and other factors.

Remote workers connect directly and securely to the cloud applications they need, without routing all their traffic back through a central office. That keeps connections fast and security consistent, wherever people work.

It depends on the number of sites, how complex your network is and how quickly internet connections can be installed at each location.

We start by designing the architecture and testing it for compatibility with your existing network equipment and systems. We usually deploy a pilot site first to confirm everything works, then roll out to the remaining sites in planned phases. Many SD-WAN devices can be configured centrally before they arrive, which speeds up installation at each location.

SASE security services are delivered from the cloud, so they can often be switched on quickly once the network design is in place. We agree a realistic rollout plan with you after assessing your sites.

Yes. Connecting your offices and users efficiently to the cloud is a core part of how we design SD-WAN and SASE.

We connect your SD-WAN directly to cloud platforms such as AWS and Microsoft Azure, so traffic to cloud applications takes the best available route instead of passing through a central office first. With SASE, users get secure, direct access to cloud applications from wherever they work.

Procain is an AWS Advanced Tier Services Partner and a Microsoft Solutions Partner for Infrastructure (Azure), so we understand how these platforms connect to your network and how to secure those connections.

SD-WAN is a networking technology. It connects your sites and chooses the best route for traffic across multiple internet connections, managed from one central platform.

SASE combines that networking with cloud-delivered security. It adds services such as secure web filtering, cloud application control, zero trust network access and firewall as a service, and applies them wherever users are.

SASE doesn't replace SD-WAN. It builds on it. A business with several offices that mainly needs better connectivity may start with SD-WAN. A business with remote workers, heavy cloud use and a need for consistent security everywhere usually benefits from full SASE.

A traditional WAN connects offices using fixed private circuits, most often MPLS lines, and each site's equipment is configured individually. MPLS is reliable but expensive, slow to install and poorly suited to cloud applications, because traffic often travels back to a central data centre before reaching the internet.

SD-WAN uses software to manage connections across any mix of links, including broadband, fibre and 4G or 5G. It sends each application over the best route, fails over automatically when a link has problems and lets IT manage every site from one platform.

Many businesses use SD-WAN to replace MPLS entirely, or to run the two side by side while they phase MPLS out, often with lower costs and more bandwidth.

SSE (security service edge) is the security part of SASE on its own. It includes the cloud-delivered security services, such as a secure web gateway, cloud access security broker and zero trust network access, but not the SD-WAN networking.

SASE combines SSE with SD-WAN, so networking and security work together in one service.

SSE suits businesses that already have a network they're happy with, or that have few branch offices and mostly remote users, but need modern cloud security. SASE suits businesses that want to update both their network and their security together.

It can be, but the answer depends on how your business works, not only on how many offices you have.

SD-WAN brings the most value when you have several sites, but even with two locations it can help if you rely heavily on cloud applications, video calls or internet connections that often slow down. SASE security can make sense for a small business with remote staff or sensitive data, regardless of office count.

We assess your sites, users and applications first and recommend what fits. Sometimes that's full SD-WAN or SASE. Sometimes it's a simpler setup, such as better firewalls and backup internet. We'd rather recommend what you need than sell you more than you need.

Our managed service covers ongoing operation, not just deployment.

We monitor your network continuously and report on network performance, application behaviour and security status, so you can see how your network is performing. We manage bandwidth and quality-of-service settings to keep critical applications running smoothly, and we fix problems as they arise.

For SASE, we update your security services and policies regularly to address new threats and improve performance. Our service level agreements set out our commitments for performance, availability and reliability.

It depends on the service you choose, and our quotes show exactly what's included.

Our SD-WAN service includes built-in security, such as encryption, firewall capabilities and threat detection. Full SASE adds cloud-delivered security: a secure web gateway (SWG) to filter internet traffic, a cloud access security broker (CASB) to control cloud applications, zero trust network access (ZTNA) to verify every user and device, and firewall as a service (FWaaS).

Not every business needs every component on day one. We recommend the components that match your risks and users, and your quote lists each one clearly, so you know what you're paying for and what you can add later.

We agree the contract length with you before the service starts. Many SD-WAN and SASE contracts run for three years, often because the hardware cost is spread across that period, but we set the term to suit your business.

What happens to on-site hardware depends on how you pay for it. If you buy the equipment outright, it belongs to you. If the hardware is included in a monthly fee, the contract sets out whether you can buy it at the end or return it. Some SD-WAN equipment only works with its vendor's platform and licences, so we explain this before you commit.

If you move to another provider, we hand over your network configurations, documentation and design, so the change doesn't disrupt your business.