License & Deployment Mix: 15 tools – 3 OSS, 2 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is SD-WAN?
SD-WAN (Software-Defined Wide Area Network) decouples network control from the underlying transport, enabling centralized orchestration of WAN traffic across multiple links (MPLS, broadband, LTE/5G, satellite). Traditional WANs rely on expensive MPLS circuits with static routing. SD-WAN overlays intelligent software on top of commodity internet links, using application-aware routing, path selection, and WAN optimization to deliver predictable performance at lower cost.
SD-WAN separates the data plane (packet forwarding at edge devices) from the control plane (centralized orchestration and policy management). This separation enables:
- Application-aware routing – identify applications by deep packet inspection or DNS and route them over the optimal WAN path based on real-time performance metrics
- Dynamic path selection – continuously measure latency, jitter, and packet loss across all WAN links; automatically steer traffic to the best-performing path per application SLA
- WAN optimization – TCP optimization, data deduplication, compression, and caching to improve throughput on constrained links
- Zero-touch provisioning – remote sites self-configure by pulling policy from the central orchestrator; no on-site IT staff required for deployment
- Centralized orchestration – single pane of glass for managing WAN policies, routing, QoS, and security across all sites
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
This comparison covers open-source and commercial SD-WAN platforms across deployment, features, security, and integration.
Deployment & Licensing
| Tool | License | Self-Hosted | Form Factor | Pricing |
|---|---|---|---|---|
| flexiWAN | AGPL-3.0 | Yes | Software (x86) | Free (OSS) / Paid (SaaS mgmt) |
| VyOS | GPL-2.0 | Yes | Software (x86/ARM) | Free (rolling) / Paid (LTS) |
| OpenWrt | GPL-2.0 | Yes | Router firmware | Free |
| Fortinet | Proprietary | Yes (appliance) | HW + VM | Per-device license |
| Meraki | Proprietary | No (cloud-mgd) | HW appliance | Per-device subscription |
| Viptela | Proprietary | Yes (on-prem ctrl) | HW + VM | Per-device license |
| VeloCloud | Proprietary | Yes (on-prem orch) | HW + VM | Per-device subscription |
| Cato | Proprietary | No (cloud) | Edge socket + PoP | Per-site subscription |
| Peplink | Proprietary | Yes (appliance) | HW appliance | Per-device (perpetual) |
| Versa | Proprietary | Yes (on-prem) | HW + VM | Per-device license |
| Aruba EC | Proprietary | Yes (on-prem orch) | HW + VM | Per-device subscription |
| Juniper Mist | Proprietary | No (cloud) | HW (SRX/SSR) | Per-device subscription |
| Barracuda | Proprietary | Yes (on-prem) | HW + VM | Per-device subscription |
| Aryaka | Proprietary | No (managed) | CPE + PoP | Per-site subscription |
| Prisma SD-WAN | Proprietary | No (cloud) | HW (ION) + VM | Per-device sub |
Core SD-WAN Features
| Tool | App-Aware | Path Select | WAN Opt | ZTP | Central Orch |
|---|---|---|---|---|---|
| flexiWAN | Yes (DPI) | Yes | No | Yes | Yes (cloud/self) |
| VyOS | Limited | Policy routing | No | No (manual) | No (CLI-based) |
| OpenWrt | No | MWAN3 (basic) | No | No | No |
| Fortinet | Yes (DPI) | Yes (SLA) | Yes | Yes | FortiManager |
| Meraki | Yes (DPI) | Yes (SLA) | No | Yes | Meraki Dashboard |
| Viptela | Yes (DPI) | Yes (SLA) | Yes | Yes | vManage |
| VeloCloud | Yes (DPI) | Yes (DMPO) | Yes | Yes | VCO |
| Cato | Yes (DPI) | Yes | Yes | Yes | Cato Mgmt App |
| Peplink | Limited | Yes (SLA) | Yes (SpeedFusion) | Yes | InControl 2 |
| Versa | Yes (DPI) | Yes (SLA) | Yes | Yes | Versa Director |
| Aruba EC | Yes (DPI) | Yes (SLA) | Yes (boost) | Yes | Aruba Central |
| Juniper Mist | Yes (DPI) | Yes (SLA) | No | Yes | Mist Cloud |
| Barracuda | Yes (DPI) | Yes (SLA) | Yes | Yes | Firewall Admin |
| Aryaka | Yes (DPI) | Yes (managed) | Yes | Yes (managed) | MyAryaka |
| Prisma SD-WAN | Yes (DPI) | Yes (SLA) | No | Yes | Prisma SD-WAN ctrl |
Best app-aware routing: Fortinet, Viptela, VeloCloud, Cato, Versa, Aruba EdgeConnect (full DPI with per-application SLA policies)
Best WAN optimization: VeloCloud (DMPO), Aruba EdgeConnect (boost), Aryaka (managed optimization), Peplink (SpeedFusion bonding)
Open-source leader: flexiWAN (only true open-source SD-WAN with DPI and path selection)
Multi-Link & Failover
| Tool | Active/Active | Bonding | LTE/5G | Sub-sec Failover | FEC |
|---|---|---|---|---|---|
| flexiWAN | Yes | No | Yes | Yes (BFD) | No |
| VyOS | Yes | No | Yes | No | No |
| OpenWrt | Yes (MWAN3) | No | Yes | No | No |
| Fortinet | Yes | No | Yes (FortiExtender) | Yes (BFD) | Yes |
| Meraki | Yes | No | Yes (MX + MG) | Yes | No |
| Viptela | Yes | No | Yes | Yes (BFD) | Yes |
| VeloCloud | Yes | Yes (DMPO) | Yes | Yes | Yes |
| Cato | Yes | Yes (PoP) | Yes (socket) | Yes | Yes |
| Peplink | Yes | Yes (SpeedFusion) | Yes (built-in) | Yes | Yes |
| Versa | Yes | No | Yes | Yes (BFD) | Yes |
| Aruba EC | Yes | Yes (tunnel) | Yes | Yes | Yes |
| Juniper Mist | Yes | No | Yes (SRX) | Yes | No |
| Barracuda | Yes | Yes | Yes | Yes | Yes |
| Aryaka | Yes | Yes (managed) | Yes | Yes | Yes |
| Prisma SD-WAN | Yes | No | Yes | Yes | Yes |
Best bonding: Peplink (SpeedFusion – true per-packet bonding across links), VeloCloud (DMPO), Aruba EdgeConnect
Best cellular: Peplink (built-in LTE/5G modems in most models), Cato (cellular socket)
Security Integration
| Tool | NGFW | IPS/IDS | URL Filter | SASE | Segmentation |
|---|---|---|---|---|---|
| flexiWAN | No | No | No | No | VRF-lite |
| VyOS | Firewall (zone) | Snort (pkg) | No | No | VRF |
| OpenWrt | iptables/nft | No | No | No | VLAN |
| Fortinet | Yes (FortiGate) | Yes | Yes | Yes (SASE) | VRF + VDOM |
| Meraki | Yes | Yes | Yes | Yes (Umbrella) | VLAN |
| Viptela | Yes (IOS-XE) | Yes (Snort) | Yes (Umbrella) | Yes (SSE) | VPN/VRF |
| VeloCloud | Yes | Yes | Yes | Yes (SSE) | Segments |
| Cato | Yes | Yes | Yes | Yes (native) | Segments |
| Peplink | Basic | No | Content filter | No | VLAN |
| Versa | Yes | Yes | Yes | Yes (SASE) | VRF |
| Aruba EC | Basic (ACL) | Yes (partner) | Yes (partner) | Yes (SSE) | Zones |
| Juniper Mist | Yes (SRX) | Yes | Yes | Yes (SSE) | VRF |
| Barracuda | Yes | Yes | Yes | Yes | Segments |
| Aryaka | Yes (partner) | Yes (partner) | Yes | Yes (SASE) | Segments |
| Prisma SD-WAN | No (Prisma) | No (Prisma) | No (Prisma) | Yes (Prisma) | Segments |
Best integrated security: Fortinet (FortiGate NGFW is the SD-WAN edge device), Cato (native SASE stack), Versa (integrated SASE)
SASE-ready: Fortinet, Viptela/Cisco, VeloCloud, Cato, Versa, Aruba, Juniper, Barracuda, Aryaka, Prisma SD-WAN
SSO / OIDC Comparison
SSO applies to the SD-WAN orchestrator management console; the notes below assume Authentik as the external identity provider.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| flexiWAN | No | No | No | Local auth only; no SSO for mgmt console |
| VyOS | No | No | No | CLI-based; RADIUS/TACACS+ for auth |
| OpenWrt | No | No | No | LuCI web UI; local auth only |
| Fortinet | Yes | Yes | No | FortiManager SAML/OIDC; Authentik as IdP |
| Meraki | No | Yes | No | Dashboard SAML; Authentik via SAML |
| Viptela | No | Yes | No | vManage SAML; Authentik via SAML |
| VeloCloud | No | Yes | No | VCO SAML; Authentik via SAML |
| Cato | Yes | Yes | Yes | Cato Mgmt SAML/OIDC; Authentik as IdP |
| Peplink | No | No | No | InControl 2 local auth; no SSO |
| Versa | No | Yes | No | Director SAML; Authentik via SAML |
| Aruba EC | Yes | Yes | No | Aruba Central OIDC/SAML; Authentik as IdP |
| Juniper Mist | Yes | Yes | No | Mist Cloud OIDC/SAML; Authentik as IdP |
| Barracuda | No | Yes | No | Admin SAML; Authentik via SAML |
| Aryaka | No | Yes | No | MyAryaka SAML; Authentik via SAML |
| Prisma SD-WAN | Yes | Yes | Yes | Prisma OIDC/SAML/SCIM; Authentik as IdP |
Best SSO: Cato Networks, Prisma SD-WAN (OIDC + SAML + SCIM); Fortinet, Aruba, Juniper (OIDC + SAML)
No SSO: flexiWAN, VyOS, OpenWrt, Peplink (local authentication only)
API Comparison
| Tool | API Type | Auth | Webhooks | Terraform |
|---|---|---|---|---|
| flexiWAN | REST | Token | No | No |
| VyOS | REST + NETCONF | API key | No | Community |
| OpenWrt | ubus (JSON-RPC) | Session | No | No |
| Fortinet | REST | Token | Yes | Yes (official) |
| Meraki | REST | API key | Yes | Yes (official) |
| Viptela | REST | Token | No | Yes (official) |
| VeloCloud | REST | Token | Yes | Community |
| Cato | GraphQL + REST | API key | Yes | Yes (official) |
| Peplink | REST | Token | No | No |
| Versa | REST + NETCONF | Token | Yes | Community |
| Aruba EC | REST | OAuth2 | Yes | Yes (official) |
| Juniper Mist | REST | Token | Yes | Yes (official) |
| Barracuda | REST | Token | No | No |
| Aryaka | REST | Token | Yes | No |
| Prisma SD-WAN | REST | OAuth2 | Yes | Yes (official) |
Best API: Meraki (extensive REST API, well documented), Fortinet (FortiOS REST API), Cato (GraphQL for flexible queries), Juniper Mist (RESTful with webhooks)
Best Terraform: Fortinet, Meraki, Viptela, Cato, Aruba, Juniper, Prisma SD-WAN (official providers)
MSP / Multi-Tenant Features
| Tool | Multi-Tenant | MSP Portal | Per-Client | Partner Program |
|---|---|---|---|---|
| flexiWAN | Yes (orgs) | Basic | Yes | No |
| VyOS | No | No | Manual | No |
| OpenWrt | No | No | Manual | No |
| Fortinet | Yes (ADOMs) | FortiCloud | Yes | Yes (Engage) |
| Meraki | Yes (orgs) | MSP portal | Yes | Yes (Meraki) |
| Viptela | Yes (tenants) | Multi-tenant | Yes | Yes (Cisco) |
| VeloCloud | Yes (partners) | MSP portal | Yes | Yes (Broadcom) |
| Cato | Yes (accounts) | Partner portal | Yes | Yes (MSSP) |
| Peplink | Yes (groups) | InControl MSP | Yes | Yes (Partner) |
| Versa | Yes (tenants) | Versa Titan | Yes | Yes (Partner) |
| Aruba EC | Yes (tenants) | MSP portal | Yes | Yes (HPE) |
| Juniper Mist | Yes (orgs) | MSP portal | Yes | Yes (Juniper) |
| Barracuda | Yes (tenants) | MSP portal | Yes | Yes (MSP) |
| Aryaka | Yes (tenants) | MyAryaka | Yes | Yes (Channel) |
| Prisma SD-WAN | Yes (tenants) | Panorama | Yes | Yes (NextWave) |
Best MSP support: Meraki (purpose-built MSP portal), VeloCloud (mature partner program), Peplink (InControl MSP dashboard), Barracuda (MSP-focused pricing and portal)
No multi-tenancy: VyOS, OpenWrt (single- instance; MSPs manage per-customer devices individually)
Monitoring Integration
| Tool | Prometheus | Structured Logs | Grafana |
|---|---|---|---|
| flexiWAN | No | File logs | None |
| VyOS | No | syslog | Community |
| OpenWrt | No | syslog/logd | Community |
| Fortinet | Yes (SNMP) | syslog/CEF | Community |
| Meraki | No (SNMP) | syslog | Community |
| Viptela | Yes (SNMP) | syslog | Community |
| VeloCloud | No (API) | syslog | None |
| Cato | No (API) | Log API | None |
| Peplink | No (SNMP) | syslog | Community |
| Versa | Yes (SNMP) | syslog | Community |
| Aruba EC | Yes (API) | syslog | Community |
| Juniper Mist | No (API) | Webhook events | None |
| Barracuda | No (SNMP) | syslog | None |
| Aryaka | No (API) | Log export | None |
| Prisma SD-WAN | No (API) | Log forwarding | None |
Best monitoring integration: Fortinet, Viptela, Versa (SNMP metrics via Telegraf + syslog to Fluent Bit); VyOS, Meraki, Peplink (SNMP + syslog)
API-based monitoring: VeloCloud, Cato, Aruba, Juniper Mist, Aryaka, Prisma SD-WAN (poll REST/GraphQL APIs via Telegraf exec or custom scripts; forward logs to Fluent Bit)
Open-source gap: flexiWAN has limited monitoring integration; no native Prometheus endpoint or structured logging
Tools
15 tools.
Aryaka
Aryaka delivers SD-WAN as a fully managed service, operating a global private backbone of 40+ PoPs connected by dedicated high-capacity links.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: none
Barracuda CloudGen WAN
Barracuda CloudGen WAN is an SD-WAN solution built on Barracuda’s CloudGen Firewall platform. Like Fortinet, Barracuda integrates SD-WAN with full NGFW capabilities in a single device.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
Cato Networks
Cato Networks pioneered the SASE (Secure Access Service Edge) category, offering a fully converged cloud-native platform that combines SD-WAN with a complete security stack (NGFW, IPS, SWG, CASB, ZTNA, DLP).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Cisco Catalyst SD-WAN (Viptela)
Cisco Catalyst SD-WAN (formerly Viptela) is Cisco’s enterprise SD-WAN platform for large- scale WAN transformation.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, appliance · SSO: none
Cisco Meraki SD-WAN
Cisco Meraki SD-WAN is delivered through the MX series security appliances, managed entirely through the Meraki cloud dashboard. Meraki’s differentiator is simplicity – all configuration is done through a web-based dashboard with no CLI.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
flexiWAN
flexiWAN is the only fully open-source SD-WAN solution. It provides application-aware routing, dynamic path selection, centralized orchestration, and zero-touch provisioning – capabilities typically found only in commercial SD-WAN platform…
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Fortinet SD-WAN (FortiGate)
Fortinet SD-WAN is integrated into FortiGate next-generation firewalls, making it unique among SD-WAN solutions: the same device provides SD-WAN traffic management and full NGFW security.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
HPE Aruba EdgeConnect (Silver Peak)
HPE Aruba EdgeConnect (formerly Silver Peak) is an enterprise SD-WAN platform known for its WAN optimization heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, appliance · SSO: none
Juniper Mist SD-WAN
Juniper Mist SD-WAN combines Juniper’s routing and security heritage with Mist’s AI-driven cloud management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: none
OpenWrt (with MWAN3)
OpenWrt is a Linux-based router firmware that runs on a wide range of consumer and commercial router hardware.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: package · SSO: none
Palo Alto Prisma SD-WAN (CloudGenix)
Palo Alto Prisma SD-WAN (formerly CloudGenix) is the SD-WAN component of Palo Alto’s Prisma SASE platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: none
Peplink
Peplink specializes in multi-WAN bonding and SD-WAN for organizations that need reliable connectivity across diverse WAN links.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
Versa Networks
Versa Networks provides an integrated SD-WAN and SASE platform built on a single software stack – Versa Operating System (VOS).
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: none
VMware VeloCloud (Broadcom)
VMware VeloCloud (now under Broadcom after the VMware acquisition) is a leading enterprise SD-WAN platform known for its Dynamic Multipath Optimization (DMPO) technology.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, appliance · SSO: none
VyOS (SD-WAN Features)
VyOS is a Linux-based network operating system that provides routing, firewall, and VPN functionality.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
