SD-WAN
Run every branch on one network, and keep working when a line drops
Join your branches to each other and to your cloud servers over their existing internet and LTE lines, as one encrypted network; traffic leaves a failing line in under a second. The management centre and gateways are in Türkiye, and every branch is run from your cloud console.
Why now
- Saturday afternoon, the shop's only internet line went down; the till couldn't take cards and customers left their baskets behind. Head-office IT found out only when the store manager phoned.
- A week before every branch opening, a technician has to visit to set up the firewall and VPN. Every branch ends up configured slightly differently, and when one step is missed the branch can't reach head office.
- In the call centre, calls break up every afternoon and 'the voice keeps dropping' complaints are climbing. Nobody can see which line is to blame.
- Your carrier's renewal quote for private circuits (MPLS) just arrived, with a hefty monthly fee per branch. You want the same job done over the internet lines the branches already have.
- Your current SD-WAN's management centre sits in a vendor cloud abroad. Your legal team wants the branch network's management data to stay in Türkiye.
What changes
| Today | With Nesnet |
|---|---|
| When a branch's only line drops, the tills, the phone system and internal apps all stop together. | A second line or LTE backup stands ready, and traffic moves off a failing line in under a second. |
| A technician visits every new branch, and each setup is done by hand, a little differently. | Someone at the branch plugs in power and internet, and the settings arrive from the central profile on their own. |
| Nobody can see why call quality fell apart. | The console shows loss, latency and utilisation for every line, and voice traffic is protected when packets go missing. |
| Branch-to-branch links depend on an expensive private circuit at every site. | Branches meet on one encrypted network over existing internet lines, with any private circuit kept as a backup. |
| The management centre lives in a vendor cloud abroad. | The management centre and gateways run, redundantly, on Nesnet infrastructure in Türkiye. |
From today to live: how it works
- 1
Discovery call
Walk Nesnet's team through your branch count, the lines at each branch and the applications you run in the cloud. You leave knowing each branch's licence tier, the devices you need and what drives the price.
- 2
Your environment is prepared
Nesnet's add-on opens your organisation in the management centre, creating the gateway pool, ready profile, licence and cloud tunnel. The branch address block is planned up front for your number of branches.
- 3
Pilot branch
The first branch is added in the console, its device is plugged in and it pulls its settings from the profile. Line failover, call quality and cloud access are tested at that branch.
- 4
Branches join one by one
The remaining branches join with the same profile, one at a time. Each branch goes live on its own day, without touching anyone else's connection.
- 5
Monitoring and growth
Branches are followed on the map, with line health and alarms in the console. As new branches open, they're added in the console and just need their device plugged in.
What you get
A dropped line doesn't stop the business
When a branch line drops or its quality degrades, traffic is moved to another line within 300–500 milliseconds. A card payment at the till, a call on the phone system and a session in an internal app carry on over the new path without users noticing.
Every path, measured continuously
Loss, latency and jitter on every path between branch device and gateway are measured every 100 milliseconds. Traffic follows those measurements, and when a line starts to degrade, the next measurement changes the decision.
Calls that don't break up
When voice and video start losing packets, adaptive forward error correction (FEC) kicks in and uses the best two lines together, while other traffic simply resends what was lost. Even on a poor line, the other side doesn't miss half a sentence.
Voice that doesn't wobble
Once jitter passes 7 milliseconds on voice or 5 milliseconds on video, a jitter buffer steps in and smooths it out. Call quality holds up even on an internet line shared at the busiest hour.
Every application on its own path
More than 2,500 applications are recognised by deep packet inspection (DPI) and come with ready-made policies. Video calls take the best line, backups the cheapest, cloud apps go straight to the internet, and you decide each application's path with a business rule.
Use your existing lines together
Each internet line at a branch is set as active, backup or hot standby, and active lines are used side by side. Two inexpensive lines from different carriers give you redundancy that a single expensive line can't.
A backup line over LTE
An LTE-equipped branch device can be rented, with the LTE link added as a backup. When roadworks cut the cable or a carrier has an outage, the branch keeps working over the mobile network.
Your private circuit as the last resort
If a branch also has a private circuit (MPLS), internet-bound traffic is carried over it to the hub when every internet line is down (conditional backhaul). Your existing circuit contract isn't wasted before it ends; it becomes SD-WAN's backup path.
Opening a branch is as easy as plugging in a device
Add the branch in the console and an activation key is generated for its device; someone at the branch plugs in power and internet, and the configuration arrives from the central profile. No technician visit, and the new branch joins the network the same day.
Branches reach each other directly
Encrypted branch-to-branch connectivity is on by default and can be switched off in the console. Traffic between a regional office and a depot never detours through head office, and the head-office line doesn't carry every branch's load.
Straight to your cloud servers
The branch network reaches your cloud servers through encrypted tunnels from the SD-WAN gateways into your cloud network. There's a separate, active/active tunnel per gateway, so if one gateway fails, the other tunnel keeps carrying traffic.
Choose where traffic leaves for the internet
By default, branch internet traffic leaves straight from the branch. If you prefer, it's carried to the Nesnet data centre and leaves through your cloud environment's router with address translation, or passes through your own central firewall, and you can change that choice later.
Intrusion prevention and web filtering at the branch
On top of stateless and stateful firewalling, advanced security services run on the branch device: intrusion detection and prevention (IDS/IPS), URL category and reputation filtering, and malicious-IP blocking. Inspection covers branch-to-branch, head-office and internet traffic, without a separate appliance at each site.
Split the network inside each branch
Point-of-sale systems, staff computers and guest Wi-Fi run in separate segments that can't reach each other. A phone on the guest network can't even see the network where the payment system lives.
See line health in the console
The cloud console shows utilisation, loss and latency for every line, with the busiest and lossiest lines on their own card. History charts are kept at five-minute intervals, so 'which line went bad yesterday afternoon?' is answered with a graph.
Alarms reach head office before the branch calls
Line and device alarms, change history and the cloud tunnel's status sit on the same screen. Head-office IT learns that a branch has dropped to its backup line before the shop phones, and reads in the history who changed what.
Fix things without travelling
Restart a branch device remotely from the console, at service or device level. Per-branch LAN and DHCP settings, the Wi-Fi network name (SSID) and a private DNS server for internal company domains are in the console too.
Your branches on a map
Each branch's location is entered with a city picker and shown on a map in the console. At a glance you see how many branches in a region are running on backup, or which city's lines are struggling.
A second device for critical branches
Critical branches can run an active-standby pair with a second device of the same model. If the working device fails, the other one carries the branch, so it stays open until the replacement arrives.
One console, one sign-in
SD-WAN management is built into the cloud console you already use, with no separate account. For detailed settings, jump to the management console in one click with corporate single sign-on (SSO).
Why Nesnet
A management centre in Türkiye
An SD-WAN management centre usually runs in the vendor's cloud abroad. Nesnet runs it on its own infrastructure in Türkiye, with redundancy, and branch traffic passes through Nesnet's own SD-WAN gateways without a stop in a vendor cloud overseas.
The cloud link stays inside
For every customer, route-based, active/active encrypted tunnels run from the SD-WAN gateways to the cloud router. Branches reach your cloud servers through them, with no separate VPN appliance on the cloud side.
Managed in the cloud console you already use
The SD-WAN add-on Nesnet wrote sets each customer up in the management centre, the cloud network and the cloud console in a single automated flow. Branch fleet, lines, alarms and the cloud tunnel sit in one console, with no separate account.
Devices tested in the lab
Nesnet tests different hardware branch devices and the virtual branch device in its own lab. The rental option includes an LTE-equipped branch device, giving a branch a backup link without a second carrier line.
Branch, line and cloud under one team
The management centre, gateways, cloud tunnels and add-on are all run by the same Nesnet team. When a branch can't reach the cloud, the problem isn't bounced between a device vendor, a carrier and a cloud provider.
Example scenarios
A retail chain whose tills keep working when the line drops
Situation
A retail chain's shops run on a single internet line each; when it drops, the payment system and stock app stop. Head-office IT only hears about it when a shop phones.
Outcome
Each shop gets an LTE-equipped branch device; when the main line drops, traffic moves to LTE and the tills keep working. Line loss and latency show in the cloud console, and alarms reach head office before any shop picks up the phone.
A phone system in the cloud, call centres in two cities
Situation
A company with call centres in two cities runs its phone system on the Nesnet cloud. At peak times, calls break up and audio quality suffers.
Outcome
Voice traffic goes multi-path over two lines; when loss begins, error correction uses both lines together and the jitter buffer smooths the swings. Traffic to the phone system reaches the cloud environment through active/active tunnels from the gateways.
A branch network moving from private circuits to internet lines
Situation
A distribution company's regional depots connect to head office over carrier private circuits, and the renewal quote is over budget.
Outcome
The depots get internet lines from two different carriers plus a branch device, and meet on one encrypted network over those lines. The private circuits stay on as the conditional backhaul path until their contracts end, then they're switched off.
A new branch opened without a technician
Situation
A fast-growing café chain opens a new branch every month. Sending a technician to set up the network for each opening keeps pushing launch dates back.
Outcome
The new branch is added in the console and its device is shipped by courier. The branch manager plugs in power and internet, the settings arrive from the central profile, and the branch joins the network the same day.
One design instead of a security appliance per branch
Situation
An organisation's security policy requires branch internet traffic to be inspected. Putting a separate security appliance in every branch is both expensive and hard to manage.
Outcome
Intrusion prevention and web filtering are switched on in the branch devices, with rules flowing to every branch from the central profile. Some branches send their traffic to the central firewall instead, and both approaches work side by side in one SD-WAN network.
Who does what
| Nesnet | You |
|---|---|
| Runs the management centre with redundancy, along with the gateways and cloud tunnels. | Provide the branch internet lines and any private circuit. |
| Sets up your organisation and ready profile in the management centre, plus the cloud-side connection, with its add-on. | Plan for the branch device to be plugged in and connected to the internet on site. |
| Manages the cloud-side firewall rules SD-WAN needs, without touching your own rules. | Decide which application takes which path, where internet traffic leaves and how the security services' rules are set. |
| Supplies the rental branch device and its licence. | Manage branch LAN addresses, DHCP and Wi-Fi settings in the console. |
Who it is for
Businesses with many branches
Businesses with several locations — shops, depots, regional offices — that want them linked to each other and to their cloud servers as one network. A new branch joins the day its device is plugged in.
Shops whose tills stop when the line drops
Branches whose payment system, stock app and camera recording all hang on a single internet line. With a second line or LTE backup, the tills keep working when the main line goes down.
Branches where call quality matters
Call centres, remote offices and teams that work over video. Voice and video are protected with error correction when packets are lost and a buffer when jitter rises.
Single-line or rural branches
Branches in rural areas or on a single carrier's line. The LTE-equipped branch device brings a backup line straight out of the box.
Organisations wanting central control
Organisations that want branch internet traffic to pass through a central firewall, or intrusion prevention and web filtering at every branch. Rules flow down to all branches from a central profile.
May not be the right fit
SD-WAN is more than you need to connect a single office to the cloud; with Site-to-Site VPN, your office firewall connects straight to your cloud gateway.
SD-WAN isn't for individual users connecting from home; it joins branches, not people.
Under the hood
The service has three parts: the device at the branch, the SD-WAN gateways that receive branch traffic, and the management plane that runs every branch. Nesnet operates both central parts, the gateways and the management plane, on its own infrastructure in Türkiye. On top of that, Nesnet wrote its own add-on for the cloud console. The add-on creates the customer's enterprise in the management plane together with the gateway pool, a ready profile, licences and branch settings, and prepares the tunnels and firewall rules in the cloud network. Traffic between branch device and gateway is carried by multipath optimisation and encrypted with IPsec built on IKEv2 and PKI.
Building blocks
- SD-WAN management plane and branch devices
- branch, profile and policy management; hardware or virtual device at the branch, with an LTE-capable branch device available to rent
- SD-WAN gateways
- gateways run by Nesnet that receive branch traffic and carry it to the cloud
- Nesnet SD-WAN add-on
- tenant screens in the cloud console and one-step provisioning
- Dedicated cloud gateway
- cloud-side endpoint of the IPsec tunnels
- Nesnet Identity Manager
- corporate SSO into the management console
How it compares
| Option | When it is the right choice |
|---|---|
| Site-to-Site VPN | With a single office and no need for line redundancy or application priority, one IPsec tunnel from the office firewall to the cloud gateway is the simpler answer. |
| Keeping your carrier circuits | If you are still inside an MPLS contract with your carrier and those circuits are all your branches need, staying on the existing setup until the contract ends can be the sensible choice. SD-WAN can also use those circuits alongside internet lines. |
| Running another vendor's SD-WAN yourself | If your network team has deep experience with a different SD-WAN product and wants to keep the management plane in-house, staying with it may be right; the cloud connection is then built with Site-to-Site VPN. |
Technical specifications
| Management plane | On Nesnet infrastructure in Türkiye; redundant |
|---|---|
| SD-WAN gateway | Software gateways operated by Nesnet |
| Branch device family | Hardware devices from small office to data centre class; LTE-capable devices; virtual device |
| Rental hardware | Branch device with LTE modem |
| Branch setup | Device pulls its configuration once powered on and online; e-mail activation as an alternative |
| Path measurement | Every 100 ms |
|---|---|
| Line switch-over | 300–500 ms; waits 1 min before returning to the preferred line |
| Real-time traffic | Adaptive FEC (two lines); retransmission (NACK) for other traffic |
| Jitter buffer | Above 7 ms for voice, 5 ms for video |
| Application recognition | 2,500+ applications, deep packet inspection |
| Network services | Direct internet, multipath, backhaul to a hub |
| Firewall | Stateless, stateful and advanced security services |
|---|---|
| Advanced security services | IDS/IPS, URL category and reputation filtering, malicious IP blocking |
| Tunnel encryption | IPsec, AES-128/AES-256, PKI + IKEv2 |
| Ports to open on the branch firewall | UDP 2426 (management and tunnel), UDP 500/4500 (IKEv2/NAT-T), IP 50 (ESP) |
|---|---|
| Cloud link | Route-based IPsec, a separate tunnel per gateway, active/active, ECMP static routes |
| Line modes | Active, backup, hot standby; LTE as backup |
| Conditional backhaul | Internet traffic over the private circuit (MPLS) to a hub when internet lines are down |
| Segments (VRF) | 32 on small branch devices; 128 on larger branch devices and the virtual device |
| Branch device high availability | Active/Standby pair, cluster, VRRP with a third-party router |
| Branch licence | Tiered by bandwidth |
If something breaks
If a branch line drops or degrades
Traffic is steered onto another line within 300–500 milliseconds. When the line recovers, traffic is not pulled back at once: it waits one minute before returning to the preferred line, so a flapping line does not keep disrupting traffic.
If every internet line goes down
If the branch has a private circuit, conditional backhaul kicks in and internet-bound traffic is carried over that circuit to a hub. Once an internet line is back, traffic returns to its usual path.
If the active management plane fails
Branch devices switch to the standby management plane on their own, and management carries on from the standby instance.
If a gateway fails
The cloud link has a separate tunnel for each gateway, running active/active. When one gateway goes down, the other tunnel keeps carrying traffic.
If the device at a branch fails
Critical branches can run a second device of the same type as an Active/Standby pair. If the working device fails, the other member of the pair carries the branch.
Frequently asked questions
Pricing and first steps
Pricing
SD-WAN is billed monthly per branch. Each branch's licence is set by the bandwidth tier it needs; a branch device can be rented if you like, and advanced security services and the per-branch managed service are separate lines. Invoices are issued as e-Invoice or e-Archive documents.
What the price depends on
- Number of branches
- The licence bandwidth tier of each branch
- Licence for the advanced security services (intrusion prevention, web filtering)
- Rental branch device (optional)
- The per-branch managed service item
- On the cloud side, the cloud organisation and a public IP for internet egress through the data centre
How to get started
- 1.Tell us about your branches and lines using the form, or call 0800 606 1071.
- 2.Per-branch licences, devices and price are worked out in one call.
- 3.Your environment is prepared, and your first branch device joins the network the day it's plugged in.
Bring your branches together on one network
Tell Nesnet's team how many branches you have, which lines they use and what must keep running no matter what; you'll hear back within the same business day. The management centre is in Türkiye, and your branches are run from your cloud console.