Software-defined networking (SDN) is a general approach that separates the control of a network from the forwarding of packets. SD-WAN is a use of software-defined control for wide area links between sites and clouds. SDN describes how a network is built; SD-WAN describes one place it is applied.
What does SDN mean in a standard?
RFC 7426 defines SDN as a programmable networks approach that supports the separation of control and forwarding planes via standardized interfaces. It lays out planes from bottom to top: the forwarding plane, which handles packets in the data path; the operational plane, which tracks the state of devices; the control plane, which decides how packets are forwarded and pushes those decisions to devices; the management plane, which monitors, configures and maintains devices over longer timescales; and the application plane, which holds applications and services that define network behavior.
It also describes abstraction layers between them, such as the Device and resource Abstraction Layer and the Control Abstraction Layer. The key idea is a central, programmable control layer rather than every device deciding alone.
Where does SD-WAN fit?
RFC 7426 does not define SD-WAN. In general usage, SD-WAN applies the same central policy approach to the wide area: branch offices, data centers and cloud networks linked over mixed connections. An operator sets policy once, such as "send voice over the lowest-latency link and block this application class at branches," and the edge devices enforce it.
NIST SP 800-215, Guide to a Secure Enterprise Network Landscape, covers the evolving wide area network, including secure access service edge, in the setting of multi-cloud services, geographically distributed data centers and microservices based applications. SD-WAN appears in that document's keywords, so it is part of the same conversation about how enterprise networks have changed.
What are the practical differences?
- Scope: SDN applies to any network, often a data center or campus. SD-WAN applies to links between sites, clouds and users.
- Main goal: SDN aims at programmable, centrally controlled forwarding. SD-WAN aims at policy driven path selection and management of wide area links.
- Typical owner: network engineering for both, with security often involved in SD-WAN.
A network can use SDN inside a data center and SD-WAN between its offices. They are not rivals.
What changes for security?
Centralizing control concentrates risk. The controller or orchestration service becomes a high-value target: whoever can change its policy can change the whole network. That means strong authentication for administrators, separation of duties, change approval and audit logs for configuration changes.
A constructed example. A retailer connects 80 stores with SD-WAN. A central policy change would apply to every store in minutes. The team requires two approvals for policy changes, logs each change with the administrator identity, and tests a change at one store first. It also keeps a documented rollback and confirms that stores keep local safe defaults if the controller is unreachable.
Segmentation still matters. NIST SP 800-53 SC-7 asks you to monitor and control communications at external and key internal interfaces, and AC-4 asks for enforcement of approved information flows between connected systems. Software-defined control makes those policies easier to apply consistently, but it does not decide them for you.
How to check or apply this
- Draw your network and mark which parts use software-defined control, and which links are wide area.
- Identify the controller or orchestration system, and list who can change its policy.
- Require multi-factor authentication, role separation and approval for policy changes.
- Log every configuration change and send logs to a separate system.
- Test what happens at a site when the controller is unreachable.
- Keep security policy, such as segmentation and default deny, defined deliberately and documented, not left to defaults.
- Review firmware and software updates for the edge devices and controllers on a schedule.
Quick check
Is SD-WAN a type of SDN?
Loosely, yes in spirit: it uses central, software-driven control. RFC 7426 defines SDN itself but does not define SD-WAN, so definitions of SD-WAN come from industry use.
Does SD-WAN replace a firewall?
Not by itself. Security functions may be built in, but you should decide what controls are needed and verify they are enforced.
Sources
- RFC 7426, Software-Defined Networking (SDN): Layers and Architecture Terminology
- NIST SP 800-215, Guide to a Secure Enterprise Network Landscape
- NIST SP 800-53 Rev. 5 control catalog, OSCAL JSON from NIST (SC-7, AC-4)
Last reviewed: 18 October 2026.
