SD-WAN vs MPLS vs VPN: Connecting Branch Offices
Advanced4 minInnovialabs editorial team
In short
A few branches usually do fine with site-to-site VPN over the internet, MPLS buys a predictable carrier link at the cost of flexibility, and SD-WAN pays off when you have many branches, several links per site, heavy cloud traffic and need central control.
The short answer
- Site-to-site VPN — encrypted tunnels over the regular internet between office routers. Cheap and quick, but every site is configured separately and quality depends on the ISPs.
- MPLS — a carrier's private network with contractual guarantees (SLA). Predictable latency, but expensive, slow to provision and awkward for cloud traffic.
- SD-WAN — a software layer over any links (internet, LTE, MPLS) with central management and application-aware routing.
If you have few branches and the IT team copes manually — VPN. If one carrier's guarantees are critical and all branches are in its footprint — MPLS. If the network is growing, sites have several links and cloud traffic matters — SD-WAN.
How each architecture works
VPN. Each site has a router or firewall, and IPsec or WireGuard tunnels run between them. Common topologies are hub-and-spoke (all branches connect to headquarters) and full mesh (every site to every site). A hand-built full mesh quickly becomes unmanageable: the number of tunnels grows with every new branch. Routing is static or uses a dynamic protocol (OSPF, BGP) over the tunnels.
MPLS. The carrier builds an isolated L3VPN for you inside its network. Branches see each other as one private network, and traffic does not cross the public internet. Classes of service (QoS) are configured by the carrier. Internet access is usually centralized through headquarters or handled separately at each site.
SD-WAN. Each site has an edge device, all managed from an orchestrator. The device builds encrypted tunnels across all available links at once, constantly measures latency, jitter and loss, and picks a path per application based on policy. A new branch comes online via zero-touch provisioning: plug the device in and it pulls its configuration.
Comparison
| Criterion | Site-to-site VPN | MPLS | SD-WAN |
|---|---|---|---|
| Transport | internet | carrier network | any: internet, LTE, MPLS |
| Link quality | no guarantees | SLA guarantees | no guarantee per link, but best-path selection |
| Resilience | depends on backup tunnel setup | depends on carrier redundancy | multiple links, automatic failover |
| Management | each device separately | by the carrier, changes via tickets | centralized, template-based |
| Cloud and SaaS | direct or via HQ | often via HQ, adding latency | local breakout by policy |
| Adding a branch | quick but manual | slow, needs a carrier circuit | quick, zero-touch |
| What drives cost | hardware and engineer time | monthly fees for circuits and ports | hardware, license subscriptions, internet links |
Actual prices vary widely by region, carrier and vendor, so compare total cost of ownership: links, hardware, licenses and staff time for support.
Application-aware routing
The defining feature of SD-WAN is application-aware routing. The device identifies the application (voice, video calls, ERP, backups) and sends it over the link that currently meets its requirements:
- VoIP and video — over the link with the lowest latency and jitter, switching instantly when quality drops.
- POS and ERP — over the most reliable link, with a fallback.
- Backups and updates — over the cheapest link, with a bandwidth cap.
Some solutions can duplicate packets of critical apps across two links or recover lost packets, but this depends on the vendor. With classic VPN you can partly assemble this from policy-based routing and scripts, but maintaining it across dozens of sites is hard.
Security
- None of the three replaces a firewall and segmentation. MPLS is isolated but does not encrypt traffic by itself.
- With local internet breakout at a branch, each site must be protected — by an NGFW built into the edge device or by cloud security (the SASE/SSE approach).
- Central management is also a single point of risk: protect orchestrator access with MFA and least-privilege roles.
When to move to SD-WAN
Signs it is time:
- the number of branches is growing and each opening takes weeks of configuration;
- sites already have two links, but failover works poorly or manually;
- most traffic now goes to cloud and SaaS but is hauled through headquarters;
- complaints about call and video quality while the internet looks "fine";
- MPLS circuits get more expensive while flexibility is lacking;
- a small IT team cannot keep up with changes on every router.
The move is usually gradual: a pilot at a few branches, then a hybrid setup where MPLS stays as one of the transports, and only then a decision about dropping it.