How do you plan an SD-WAN migration without outages?

Plan an SD-WAN migration in phases: inventory every site, circuit and application, pilot one low-risk branch, run the old and new paths in parallel, then cut over site by site with a rollback you have tested. Rushing the inventory is what causes most outages.

What is being replaced?

A software-defined wide area network (SD-WAN) connects branches, data centers and cloud services using software-defined networking, often over the Internet using overlay tunnels that are encrypted when they carry internal traffic. A common aim is to replace or reduce costlier private links such as MPLS with commercial Internet access. Encyclopedic summaries also note that SD-WAN products often use proprietary protocols to set up and manage the network, and that traffic carried over the Internet comes with no end-to-end performance guarantee, unlike a carrier service built on controlled capacity.

That last point drives the plan. You are trading guaranteed paths for managed ones, so you must know which applications need what.

How do you start?

With an inventory, not with a vendor demo. For each site record the circuits (type, bandwidth, provider, contract end date), the applications that cross the WAN, the voice and video flows, and any odd devices such as payment terminals or building controls that expect a fixed address or a particular route.

Then write down the target behavior per application class: which must prefer the fastest path, which can tolerate loss, which must never leave the corporate network. Without this list the policy configuration becomes guesswork.

What does a phased plan look like?

A constructed example. A retailer has 60 stores and two data centers, with MPLS at every store and a slow cloud path via a data center.

• Phase 1, design: inventory, application classes, addressing plan, security model, and success measures such as call quality and checkout response time.
• Phase 2, pilot: one low-traffic store, both paths live for two weeks, issues logged.
• Phase 3, waves: batches of five stores, never the busiest first, never during seasonal peaks.
• Phase 4, retire: cancel old circuits only after a quiet period, aligned with contract end dates.

The retailer's pilot finds that card terminals use a fixed route that the new policy changed. That is a cheap lesson at one store and a costly one at sixty.

What about security?

Encrypt overlay tunnels. NIST SP 800-77 Rev. 1 describes IPsec as a widely used network layer control for protecting communications, with configuration usually done through the Internet Key Exchange protocol. Check which algorithms and key lifetimes your platform uses against your policy.

Treat edge devices as exposed systems. CISA, with partner agencies, published guidance on protecting network edge devices such as firewalls, routers and VPN gateways, covering threats, mitigations for administrators and expectations for manufacturers. Plan patching and logging for your branch edge boxes from day one.

Also reconsider trust. NIST SP 800-207 describes zero trust as moving defenses from static network perimeters toward users, assets and resources, with no implicit trust based on network location. A flat overlay where every branch reaches everything repeats the old perimeter model. Segment by application and role.

How to check or apply this

1. Inventory sites, circuits, applications and special devices. Note contract end dates.
2. Define application classes and their path and security requirements.
3. Choose a pilot site with low risk and good local support.
4. Run old and new paths in parallel and measure the same metrics on both.
5. Write the rollback for each wave and test it before the cutover window.
6. Cut over in small waves, outside peak periods, with staff on call.
7. Update monitoring, logging and patch processes for the new edge devices.
8. Retire old circuits only after a stable period, and update documentation and diagrams.

Quick check

Sources

• SD-WAN overview (Wikipedia)
• NIST SP 800-77 Rev. 1: Guide to IPsec VPNs
• NIST SP 800-207: Zero Trust Architecture
• CISA: Guidance and Strategies to Protect Network Edge Devices

Last reviewed: 18 October 2026.