Software defined networking, SDN, is an architecture that separates the control of a network from the devices that forward traffic, so software can program the network. SD-WAN applies a similar idea to wide area links between sites, clouds and users. SDN is the broader idea. SD-WAN is a specific use of it.
What is SDN?
RFC 7426 from the IRTF's SDN research group exists because, as it says, there was increasing confusion about what exactly SDN is and how its layers fit together. It defines planes. The forwarding plane is the resources across network devices responsible for forwarding traffic. The control plane is the functions responsible for controlling devices, instructing them how to process and forward packets. The management plane covers monitoring, configuring and maintaining devices. Above these sits an application plane.
The core move is separating the control plane from the forwarding plane and exposing the control functions to software through defined interfaces. A controller then decides how traffic should flow and programs the devices.
What is SD-WAN?
NIST SP 800-215, its guide to securing the modern enterprise network, says that with virtualization and growing use of cloud services, enterprises began adopting a new WAN technology called SD-WAN. It says the technology removes the tight coupling between control plane and data plane functions of the network, and enables centralized specification of policies such as access control, routing and application traffic prioritization.
The same document lists design goals common to SD-WAN offerings, including extensive connectivity: securely connecting users anywhere to applications anywhere using any WAN transport, such as MPLS, broadband internet, 4G or 5G wireless; and application awareness, monitoring traffic to choose paths dynamically.
So SD-WAN uses the SDN idea of centralized control, but applies it to the links between sites, cloud and users, and often bundles path selection and security features.
How do they differ in practice?
Constructed example. A retailer has two data centers and 300 shops.
- Inside each data center, an SDN controller creates virtual networks for the payment system and the inventory system, and programs switches so they cannot talk to each other except through a firewall. That is SDN: programmable control of a network you own.
- Between the shops and the data centers, an SD-WAN service gives each shop two internet links. The central policy says card terminal traffic must use the more stable link and must never be sent to the internet in the clear. If a link degrades, traffic moves automatically. That is SD-WAN: central policy over wide area paths.
The scope differs, and so do the usual operators. SDN is often run by the data center or network team. SD-WAN is often run by the team responsible for branch and cloud connectivity, sometimes as a managed service.
What are the security implications?
Both concentrate control, which is the benefit and the risk.
- The controller is a high value target. Anyone who can program it can reroute or open the whole network. Protect it with strong authentication, network isolation, careful role design and logging of every change.
- The interfaces between controller and devices need authentication and encryption.
- Central policy is only as good as its review. A wrong rule is deployed everywhere at once.
- For SD-WAN, NIST discusses requirements for a secure SD-WAN and for an integrated security services architecture. It also describes SASE as a framework offering wide area networking and security services. Treat any bundled security as something to verify against your needs, not assume.
- Management products are internet facing in some designs. Patch them promptly.
How to check or apply this
- State which problem you have: programmable networks inside a site, or path and policy control across sites.
- List who can change controller policy, and how those changes are approved and logged.
- Confirm the control channel between controller and devices is authenticated and encrypted.
- Test failure modes: what happens if the controller is unreachable? Devices should keep forwarding with the last known policy.
- Check segmentation after each major policy change with a test host.
- Require security for management consoles: multifactor authentication, restricted source addresses and rapid patching.
- Review the exit path to the internet for each site, and where inspection happens.
Quick check
Is SD-WAN a type of SDN?
It applies the same idea of separating control from forwarding and managing policy centrally, but to wide area connectivity. Many describe it that way, though products vary.
Does SD-WAN replace a firewall?
Not by itself. Some offerings bundle security services, and NIST describes integrated models, but you should verify what a given product actually inspects and enforces.
Sources
- RFC 7426, Software-Defined Networking: Layers and Architecture Terminology
- NIST SP 800-215, secure enterprise network guide (November 2022)
Last reviewed: 18 October 2026.
