What Is SD-WAN?
Mix (15 tools)
- License: 3 open source · 12 proprietary
- Hosting: 6 self-hosted · 2 SaaS · 7 both
SD-WAN (Software-Defined Wide Area Network) decouples network control from the underlying transport, enabling centralized orchestration of WAN traffic across multiple links (MPLS, broadband, LTE/5G, satellite). Traditional WANs rely on expensive MPLS circuits with static routing. SD-WAN overlays intelligent software on top of commodity internet links, using application-aware routing, path selection, and WAN optimization to deliver predictable performance at lower cost.
SD-WAN separates the data plane (packet forwarding at edge devices) from the control plane (centralized orchestration and policy management). This separation enables:
- Application-aware routing – identify applications by deep packet inspection or DNS and route them over the optimal WAN path based on real-time performance metrics
- Dynamic path selection – continuously measure latency, jitter, and packet loss across all WAN links; automatically steer traffic to the best-performing path per application SLA
- WAN optimization – TCP optimization, data deduplication, compression, and caching to improve throughput on constrained links
- Zero-touch provisioning – remote sites self-configure by pulling policy from the central orchestrator; no on-site IT staff required for deployment
- Centralized orchestration – single pane of glass for managing WAN policies, routing, QoS, and security across all sites
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
This comparison covers open-source and commercial SD-WAN platforms across deployment, features, security, and integration.
Deployment & Licensing
| Tool | License | Self-Hosted | Form Factor | Pricing |
|---|---|---|---|---|
| flexiWAN | AGPL-3.0 | Yes | Software (x86) | Free (OSS) / Paid (SaaS mgmt) |
| VyOS | GPL-2.0 | Yes | Software (x86/ARM) | Free (rolling) / Paid (LTS) |
| OpenWrt | GPL-2.0 | Yes | Router firmware | Free |
| Fortinet | Proprietary | Yes (appliance) | HW + VM | Per-device license |
| Meraki | Proprietary | No (cloud-mgd) | HW appliance | Per-device subscription |
| Viptela | Proprietary | Yes (on-prem ctrl) | HW + VM | Per-device license |
| VeloCloud | Proprietary | Yes (on-prem orch) | HW + VM | Per-device subscription |
| Cato | Proprietary | No (cloud) | Edge socket + PoP | Per-site subscription |
| Peplink | Proprietary | Yes (appliance) | HW appliance | Per-device (perpetual) |
| Versa | Proprietary | Yes (on-prem) | HW + VM | Per-device license |
| Aruba EC | Proprietary | Yes (on-prem orch) | HW + VM | Per-device subscription |
| Juniper Mist | Proprietary | No (cloud) | HW (SRX/SSR) | Per-device subscription |
| Barracuda | Proprietary | Yes (on-prem) | HW + VM | Per-device subscription |
| Aryaka | Proprietary | No (managed) | CPE + PoP | Per-site subscription |
| Prisma SD-WAN | Proprietary | No (cloud) | HW (ION) + VM | Per-device sub |
Core SD-WAN Features
| Tool | App-Aware | Path Select | WAN Opt | ZTP | Central Orch |
|---|---|---|---|---|---|
| flexiWAN | Yes (DPI) | Yes | No | Yes | Yes (cloud/self) |
| VyOS | Limited | Policy routing | No | No (manual) | No (CLI-based) |
| OpenWrt | No | MWAN3 (basic) | No | No | No |
| Fortinet | Yes (DPI) | Yes (SLA) | Yes | Yes | FortiManager |
| Meraki | Yes (DPI) | Yes (SLA) | No | Yes | Meraki Dashboard |
| Viptela | Yes (DPI) | Yes (SLA) | Yes | Yes | vManage |
| VeloCloud | Yes (DPI) | Yes (DMPO) | Yes | Yes | VCO |
| Cato | Yes (DPI) | Yes | Yes | Yes | Cato Mgmt App |
| Peplink | Limited | Yes (SLA) | Yes (SpeedFusion) | Yes | InControl 2 |
| Versa | Yes (DPI) | Yes (SLA) | Yes | Yes | Versa Director |
| Aruba EC | Yes (DPI) | Yes (SLA) | Yes (boost) | Yes | Aruba Central |
| Juniper Mist | Yes (DPI) | Yes (SLA) | No | Yes | Mist Cloud |
| Barracuda | Yes (DPI) | Yes (SLA) | Yes | Yes | Firewall Admin |
| Aryaka | Yes (DPI) | Yes (managed) | Yes | Yes (managed) | MyAryaka |
| Prisma SD-WAN | Yes (DPI) | Yes (SLA) | No | Yes | Prisma SD-WAN ctrl |
Best app-aware routing: Fortinet, Viptela, VeloCloud, Cato, Versa, Aruba EdgeConnect (full DPI with per-application SLA policies)
Best WAN optimization: VeloCloud (DMPO), Aruba EdgeConnect (boost), Aryaka (managed optimization), Peplink (SpeedFusion bonding)
Open-source leader: flexiWAN (only true open-source SD-WAN with DPI and path selection)
Multi-Link & Failover
| Tool | Active/Active | Bonding | LTE/5G | Sub-sec Failover | FEC |
|---|---|---|---|---|---|
| flexiWAN | Yes | No | Yes | Yes (BFD) | No |
| VyOS | Yes | No | Yes | No | No |
| OpenWrt | Yes (MWAN3) | No | Yes | No | No |
| Fortinet | Yes | No | Yes (FortiExtender) | Yes (BFD) | Yes |
| Meraki | Yes | No | Yes (MX + MG) | Yes | No |
| Viptela | Yes | No | Yes | Yes (BFD) | Yes |
| VeloCloud | Yes | Yes (DMPO) | Yes | Yes | Yes |
| Cato | Yes | Yes (PoP) | Yes (socket) | Yes | Yes |
| Peplink | Yes | Yes (SpeedFusion) | Yes (built-in) | Yes | Yes |
| Versa | Yes | No | Yes | Yes (BFD) | Yes |
| Aruba EC | Yes | Yes (tunnel) | Yes | Yes | Yes |
| Juniper Mist | Yes | No | Yes (SRX) | Yes | No |
| Barracuda | Yes | Yes | Yes | Yes | Yes |
| Aryaka | Yes | Yes (managed) | Yes | Yes | Yes |
| Prisma SD-WAN | Yes | No | Yes | Yes | Yes |
Best bonding: Peplink (SpeedFusion – true per-packet bonding across links), VeloCloud (DMPO), Aruba EdgeConnect
Best cellular: Peplink (built-in LTE/5G modems in most models), Cato (cellular socket)
Security Integration
| Tool | NGFW | IPS/IDS | URL Filter | SASE | Segmentation |
|---|---|---|---|---|---|
| flexiWAN | No | No | No | No | VRF-lite |
| VyOS | Firewall (zone) | Snort (pkg) | No | No | VRF |
| OpenWrt | iptables/nft | No | No | No | VLAN |
| Fortinet | Yes (FortiGate) | Yes | Yes | Yes (SASE) | VRF + VDOM |
| Meraki | Yes | Yes | Yes | Yes (Umbrella) | VLAN |
| Viptela | Yes (IOS-XE) | Yes (Snort) | Yes (Umbrella) | Yes (SSE) | VPN/VRF |
| VeloCloud | Yes | Yes | Yes | Yes (SSE) | Segments |
| Cato | Yes | Yes | Yes | Yes (native) | Segments |
| Peplink | Basic | No | Content filter | No | VLAN |
| Versa | Yes | Yes | Yes | Yes (SASE) | VRF |
| Aruba EC | Basic (ACL) | Yes (partner) | Yes (partner) | Yes (SSE) | Zones |
| Juniper Mist | Yes (SRX) | Yes | Yes | Yes (SSE) | VRF |
| Barracuda | Yes | Yes | Yes | Yes | Segments |
| Aryaka | Yes (partner) | Yes (partner) | Yes | Yes (SASE) | Segments |
| Prisma SD-WAN | No (Prisma) | No (Prisma) | No (Prisma) | Yes (Prisma) | Segments |
Best integrated security: Fortinet (FortiGate NGFW is the SD-WAN edge device), Cato (native SASE stack), Versa (integrated SASE)
SASE-ready: Fortinet, Viptela/Cisco, VeloCloud, Cato, Versa, Aruba, Juniper, Barracuda, Aryaka, Prisma SD-WAN
SSO / OIDC Comparison
SSO applies to the SD-WAN orchestrator management console; the notes below assume Authentik as the external identity provider.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| flexiWAN | No | No | No | Local auth only; no SSO for mgmt console |
| VyOS | No | No | No | CLI-based; RADIUS/TACACS+ for auth |
| OpenWrt | No | No | No | LuCI web UI; local auth only |
| Fortinet | Yes | Yes | No | FortiManager SAML/OIDC; Authentik as IdP |
| Meraki | No | Yes | No | Dashboard SAML; Authentik via SAML |
| Viptela | No | Yes | No | vManage SAML; Authentik via SAML |
| VeloCloud | No | Yes | No | VCO SAML; Authentik via SAML |
| Cato | Yes | Yes | Yes | Cato Mgmt SAML/OIDC; Authentik as IdP |
| Peplink | No | No | No | InControl 2 local auth; no SSO |
| Versa | No | Yes | No | Director SAML; Authentik via SAML |
| Aruba EC | Yes | Yes | No | Aruba Central OIDC/SAML; Authentik as IdP |
| Juniper Mist | Yes | Yes | No | Mist Cloud OIDC/SAML; Authentik as IdP |
| Barracuda | No | Yes | No | Admin SAML; Authentik via SAML |
| Aryaka | No | Yes | No | MyAryaka SAML; Authentik via SAML |
| Prisma SD-WAN | Yes | Yes | Yes | Prisma OIDC/SAML/SCIM; Authentik as IdP |
Best SSO: Cato Networks, Prisma SD-WAN (OIDC + SAML + SCIM); Fortinet, Aruba, Juniper (OIDC + SAML)
No SSO: flexiWAN, VyOS, OpenWrt, Peplink (local authentication only)
API Comparison
| Tool | API Type | Auth | Webhooks | Terraform |
|---|---|---|---|---|
| flexiWAN | REST | Token | No | No |
| VyOS | REST + NETCONF | API key | No | Community |
| OpenWrt | ubus (JSON-RPC) | Session | No | No |
| Fortinet | REST | Token | Yes | Yes (official) |
| Meraki | REST | API key | Yes | Yes (official) |
| Viptela | REST | Token | No | Yes (official) |
| VeloCloud | REST | Token | Yes | Community |
| Cato | GraphQL + REST | API key | Yes | Yes (official) |
| Peplink | REST | Token | No | No |
| Versa | REST + NETCONF | Token | Yes | Community |
| Aruba EC | REST | OAuth2 | Yes | Yes (official) |
| Juniper Mist | REST | Token | Yes | Yes (official) |
| Barracuda | REST | Token | No | No |
| Aryaka | REST | Token | Yes | No |
| Prisma SD-WAN | REST | OAuth2 | Yes | Yes (official) |
Best API: Meraki (extensive REST API, well documented), Fortinet (FortiOS REST API), Cato (GraphQL for flexible queries), Juniper Mist (RESTful with webhooks)
Best Terraform: Fortinet, Meraki, Viptela, Cato, Aruba, Juniper, Prisma SD-WAN (official providers)
MSP / Multi-Tenant Features
| Tool | Multi-Tenant | MSP Portal | Per-Client | Partner Program |
|---|---|---|---|---|
| flexiWAN | Yes (orgs) | Basic | Yes | No |
| VyOS | No | No | Manual | No |
| OpenWrt | No | No | Manual | No |
| Fortinet | Yes (ADOMs) | FortiCloud | Yes | Yes (Engage) |
| Meraki | Yes (orgs) | MSP portal | Yes | Yes (Meraki) |
| Viptela | Yes (tenants) | Multi-tenant | Yes | Yes (Cisco) |
| VeloCloud | Yes (partners) | MSP portal | Yes | Yes (Broadcom) |
| Cato | Yes (accounts) | Partner portal | Yes | Yes (MSSP) |
| Peplink | Yes (groups) | InControl MSP | Yes | Yes (Partner) |
| Versa | Yes (tenants) | Versa Titan | Yes | Yes (Partner) |
| Aruba EC | Yes (tenants) | MSP portal | Yes | Yes (HPE) |
| Juniper Mist | Yes (orgs) | MSP portal | Yes | Yes (Juniper) |
| Barracuda | Yes (tenants) | MSP portal | Yes | Yes (MSP) |
| Aryaka | Yes (tenants) | MyAryaka | Yes | Yes (Channel) |
| Prisma SD-WAN | Yes (tenants) | Panorama | Yes | Yes (NextWave) |
Best MSP support: Meraki (purpose-built MSP portal), VeloCloud (mature partner program), Peplink (InControl MSP dashboard), Barracuda (MSP-focused pricing and portal)
No multi-tenancy: VyOS, OpenWrt (single- instance; MSPs manage per-customer devices individually)
Monitoring Integration
| Tool | Prometheus | Structured Logs | Grafana |
|---|---|---|---|
| flexiWAN | No | File logs | None |
| VyOS | No | syslog | Community |
| OpenWrt | No | syslog/logd | Community |
| Fortinet | Yes (SNMP) | syslog/CEF | Community |
| Meraki | No (SNMP) | syslog | Community |
| Viptela | Yes (SNMP) | syslog | Community |
| VeloCloud | No (API) | syslog | None |
| Cato | No (API) | Log API | None |
| Peplink | No (SNMP) | syslog | Community |
| Versa | Yes (SNMP) | syslog | Community |
| Aruba EC | Yes (API) | syslog | Community |
| Juniper Mist | No (API) | Webhook events | None |
| Barracuda | No (SNMP) | syslog | None |
| Aryaka | No (API) | Log export | None |
| Prisma SD-WAN | No (API) | Log forwarding | None |
Best monitoring integration: Fortinet, Viptela, Versa (SNMP metrics via Telegraf + syslog to Fluent Bit); VyOS, Meraki, Peplink (SNMP + syslog)
API-based monitoring: VeloCloud, Cato, Aruba, Juniper Mist, Aryaka, Prisma SD-WAN (poll REST/GraphQL APIs via Telegraf exec or custom scripts; forward logs to Fluent Bit)
Open-source gap: flexiWAN has limited monitoring integration; no native Prometheus endpoint or structured logging
Tools
15 tools.
Aryaka
Aryaka delivers SD-WAN as a fully managed service, operating a global private backbone of 40+ PoPs connected by dedicated high-capacity links.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Barracuda CloudGen WAN
Barracuda CloudGen WAN is an SD-WAN solution built on Barracuda’s CloudGen Firewall platform. Like Fortinet, Barracuda integrates SD-WAN with full NGFW capabilities in a single device.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Cato Networks
Cato Networks pioneered the SASE (Secure Access Service Edge) category, offering a fully converged cloud-native platform that combines SD-WAN with a complete security stack (NGFW, IPS, SWG, CASB, ZTNA, DLP).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Cisco Catalyst SD-WAN (Viptela)
Cisco Catalyst SD-WAN (formerly Viptela) is Cisco’s enterprise SD-WAN platform for large- scale WAN transformation.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct, appliance · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Key-based access
Cisco Meraki SD-WAN
Cisco Meraki SD-WAN is delivered through the MX series security appliances, managed entirely through the Meraki cloud dashboard. Meraki’s differentiator is simplicity – all configuration is done through a web-based dashboard with no CLI.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Key-based access
flexiWAN
flexiWAN is the only fully open-source SD-WAN solution. It provides application-aware routing, dynamic path selection, centralized orchestration, and zero-touch provisioning – capabilities typically found only in commercial SD-WAN platform…
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Fortinet SD-WAN (FortiGate)
Fortinet SD-WAN is integrated into FortiGate next-generation firewalls, making it unique among SD-WAN solutions: the same device provides SD-WAN traffic management and full NGFW security.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Key-based access
HPE Aruba EdgeConnect (Silver Peak)
HPE Aruba EdgeConnect (formerly Silver Peak) is an enterprise SD-WAN platform known for its WAN optimization heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct, appliance · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Key-based access
Juniper Mist SD-WAN
Juniper Mist SD-WAN combines Juniper’s routing and security heritage with Mist’s AI-driven cloud management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
OpenWrt (with MWAN3)
OpenWrt is a Linux-based router firmware that runs on a wide range of consumer and commercial router hardware.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Palo Alto Prisma SD-WAN (CloudGenix)
Palo Alto Prisma SD-WAN (formerly CloudGenix) is the SD-WAN component of Palo Alto’s Prisma SASE platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Peplink
Peplink specializes in multi-WAN bonding and SD-WAN for organizations that need reliable connectivity across diverse WAN links.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential · Key-based access
Versa Networks
Versa Networks provides an integrated SD-WAN and SASE platform built on a single software stack – Versa Operating System (VOS).
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
VMware VeloCloud (Broadcom)
VMware VeloCloud (now under Broadcom after the VMware acquisition) is a leading enterprise SD-WAN platform known for its Dynamic Multipath Optimization (DMPO) technology.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct, appliance · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Key-based access
VyOS (SD-WAN Features)
VyOS is a Linux-based network operating system that provides routing, firewall, and VPN functionality.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
