SD-WAN and network transformation.

Before anyone talks about appliances, we map where traffic actually goes: which applications are in Azure, which sit in a colocation cage at Equinix, which SaaS platforms carry the business day to day, and which legacy systems still expect a private path. That map decides the design. Choosing a vendor first is how organisations end up paying for capability they never use.

SD-WAN gives you cheap, diverse transport with policy on top: broadband, fibre and LTE bonded per site, with application-aware steering so voice and trading traffic take the good path and backups take what is left. The value is not the cost saving on circuits, it is that you can change policy centrally in minutes instead of raising a change request per branch.

We design with Cisco and equivalent platforms, and we build the underlay with the same rigour: redundant last miles from different carriers, sane failover timers, and monitoring that tells you when a path degraded rather than when it died.

Once traffic leaves the branch directly for the internet, the old central firewall stops seeing it. That is where zScaler-style secure access and Checkpoint or Cloudflare edge enforcement come in: inspection, DNS control and zero-trust access applied per user and per device instead of per office. Identity becomes the perimeter, and the network only has to be fast and reliable.

Network transformation without datacenter work is half a project. We usually find three or four racks of workloads that should be in a public cloud, one or two that must stay physical for latency or licensing reasons, and a long tail nobody owns. Consolidating into a smaller, well-connected footprint at a carrier-neutral facility makes every later decision cheaper.

We run migrations site by site, starting with locations where a bad hour is survivable and ending with the ones that are not. Each wave has a pre-flight checklist, a defined rollback, and a person on site or on call who knows the building. Hybrid running, MPLS and SD-WAN live together, is normal for months and should be planned for, not treated as failure.

After cutover the work becomes observability and discipline: end-to-end application performance, per-site health, policy change review and quarterly design revisits as the application estate keeps moving. A network transformation that nobody maintains drifts back to its old shape within two years.

A branch gets two independent transports from different carriers, usually fibre plus a cable or 5G backup, terminated on a redundant pair of Cisco or Fortinet edges. Application-aware policy steers voice, ERP and trading flows over the healthiest path and pushes backups and updates to the cheaper one. Internet-bound traffic breaks out locally and is inspected by zScaler or Cloudflare before it ever reaches a datacenter.

A regional hub sits in a carrier-neutral facility such as Equinix, holding the private interconnects into Azure and AWS, the remaining physical workloads, and the shared services that cannot live in a branch. Everything else is policy, not cabling. That is the difference between a network you configure and a network you operate.