How Much Does SD-WAN Cost? Pricing Models Explained (2026)

SD-WAN cost is not one number, and none of the five major vendors we checked (Cisco, Meraki, Fortinet, HPE Aruba and Palo Alto Networks) publishes a branch list price on its own site. What you pay is the product of sites, edge devices, license tier, bandwidth band and term, plus circuits, security, implementation and the people who run it.

If you have been asked to budget an SD-WAN rollout, or to sanity-check a quote that already landed on your desk, the more useful question is which of the lines below are in the quote, and which will arrive later. If you are pricing lab rental, certification fees, a home multi-WAN router or AWS Cloud WAN instead, those are different purchases with different pricing.

• The SD-WAN cost stack at a glance
• Why SD-WAN vendors do not publish prices
• How SD-WAN is priced: the licensing models
• Hardware, virtual and cloud edges
• Controllers: vendor-hosted or on-premises
• The underlay: circuits are a separate bill
• Managed SD-WAN and SASE bundles: what moves into the monthly fee
• When SD-WAN does not save money over MPLS
• Renewal, co-term and exit: the costs after year one
• SD-WAN cost worksheet: compare quotes line by line
• Test before you sign: what a lab can and cannot tell you
• Conclusion

The SD-WAN cost stack at a glance

Before you sign a multi-year commitment, you can stand the design up in a lab and break it on purpose, whether through a vendor proof-of-concept program, a self-built EVE-NG or Cisco Modeling Labs environment, an integrator's lab, or a hosted proof-of-concept lab from CloudMyLab. A lab will not price your circuits. It will show you which license tier your design needs before that tier is written into the order.

Why SD-WAN vendors do not publish prices

Enterprise SD-WAN is sold through partners, on quotes, which is why SD-WAN cost is so hard to find in public. Vendor ordering guides and licensing pages list SKUs, tiers and terms. The price depends on the partner, the discount, the term length, the bandwidth band and whatever else is on the same order.

So the price ranges you find online come from managed service providers, telecom brokers, benchmarking firms and calculator sites. Some are honest worked examples, but none is a vendor price list. Before you use one, check whose estimate it is, which vendor and tier it assumes, and whether it includes circuits, security and hardware or only the SD-WAN license. If a figure cannot answer those questions, leave it out of the budget.

Cloud marketplaces are the exception. Virtual SD-WAN and firewall appliances are listed on AWS Marketplace and similar storefronts with hourly software charges, and the cloud provider's compute and data charges come on top. That helps you price one cloud edge. It does not price a branch rollout.

How SD-WAN is priced: the licensing models

Vendors meter SD-WAN in four main ways: per device, per bandwidth tier, per site, or as part of a firewall or security subscription. Managed providers then wrap any of these in a monthly fee. The metric decides what happens to the bill when a site grows, when traffic breaks out locally to the internet, or when one site needs one more feature.

Cisco Catalyst SD-WAN: bandwidth tiers are cliffs

Cisco now markets the product as Catalyst SD-WAN. Older documentation, quotes and labs still use the Viptela, vManage, vSmart and vBond names. According to Cisco's DNA subscription FAQ (updated June 16, 2026), the current SD-WAN tiers are DNA Essentials and DNA Advantage. DNA Premier for SD-WAN and Routing was discontinued in August 2024, so a quote or a blog post that still offers it is out of date.

Each edge is licensed for a bandwidth tier, and the tiers are steps. Tier 0 covers up to 25 Mbps nominal (50 Mbps aggregate), Tier 1 up to 200 Mbps (400 Mbps aggregate), Tier 2 up to 1 Gbps (2 Gbps aggregate) and Tier 3 up to 10 Gbps (20 Gbps aggregate). A branch that grows from 180 Mbps to 220 Mbps does not pay for 40 more megabits; it moves to the next tier.

Cisco's FAQ tells you to choose the tier "based on all WAN traffic," and lists IPsec to Zscaler or any other security gateway and direct internet traffic alongside the SD-WAN overlay itself. If your design breaks traffic out locally at the branch, that traffic is in the tier. Encryption has its own limit. On platforms without a valid HSEC license, encrypted traffic is throttled at 250 Mbps.

The feature tier is also an estate-wide decision in two places. Cisco's FAQ states that Catalyst SD-WAN Analytics and unlimited segmentation are available only if the entire overlay is on DNA Advantage. Essentials is limited to 10 user VPNs plus one management VPN. If one site needs an eleventh segment, or you want analytics anywhere, the whole overlay moves to Advantage.

The DNA subscription includes software support and TAC access for the SD-WAN software, but Cisco's FAQ says support for the underlying router hardware, including its OS and network stack, is handled by a service contract on the hardware. If the old platform reaches end of support during an active subscription, you can move the subscription to new hardware. You still buy the new hardware.

Cisco Meraki MX: the license is what keeps the box running

Meraki sells MX licenses in three editions under its co-termination and per-device models: Enterprise, Advanced Security and Secure SD-WAN Plus. In Meraki's own descriptions, Enterprise is for "Auto VPN and a firewall," Advanced Security adds UTM for sites that connect directly to the internet, and Secure SD-WAN Plus is for businesses reliant on SaaS, IaaS or data-center applications. Newer subscription licensing uses different tier names, so check which model your quote is written under. According to Meraki's MX licensing documentation, each license includes device RMA, 24x7 enterprise support and software upgrades.

Two licensing behaviors affect cost. Under co-termination, every license in the organization shares one expiration date, calculated by averaging all active licenses. Adding a new multi-year license to an existing estate moves the shared date instead of giving the new devices their own clock. And if the organization falls out of compliance, it enters a 30-day grace period, after which Meraki devices shut down until licensing is back in compliance.

Fortinet, HPE Aruba and Palo Alto in brief

According to Fortinet's Secure SD-WAN ordering guide, SD-WAN can be enabled on all FortiGate models at no additional cost, with no extra license requirement or bandwidth limitation. What you renew is the security side. Fortinet recommends security subscription services and sells SD-WAN Services bundles per FortiGate, which include FortiCare; the lower-priced add-on versions do not. As of January 2026, the older individual SD-WAN and SASE SKUs are sold only through the bundle.

HPE Aruba EdgeConnect is licensed per gateway, physical or virtual, on an aggregate WAN bandwidth tier, in Foundation and Advanced tiers on multi-year terms that vary by SKU family, according to HPE's EdgeConnect QuickSpecs. The orchestrator can be cloud-hosted by HPE or run on your own servers under an on-premises tier.

Palo Alto Networks licenses Prisma SD-WAN branches per device, per site or on aggregate bandwidth, with bandwidth tiers from 25 Mbps to 2,500 Mbps. Subscriptions have a minimum term of one year and a maximum of five.

Hardware, virtual and cloud edges

Every site needs an edge. Branch appliances are bought up front and replaced when the vendor retires the model. High availability means a second edge at the site, and often the switching to connect both, which is easy to leave off a per-site figure.

Virtual edges move the cost rather than removing it. Cisco Catalyst 8000V, FortiGate-VM, EdgeConnect virtual gateways, Palo Alto virtual ION and Meraki vMX run on your hypervisor or in a public cloud. On-premises, you supply the compute. In a cloud, you pay the provider for the instance, any marketplace software charge, and data leaving the cloud. A cloud hub that routes traffic through a separate transit network can be billed for egress more than once. Model the traffic path before you model the price.

Controllers: vendor-hosted or on-premises

The management and control layer is either hosted by the vendor or run by you. Cisco recommends cloud-hosted Catalyst SD-WAN Manager, Controller and Validator, and supports on-premises and hybrid deployments. HPE offers a cloud orchestrator or an on-premises tier. Meraki is managed from its cloud dashboard only.

Hosted control usually sits inside the subscription. On-premises control means your servers, your backups, your upgrade windows and the people to do them. If you are required to keep management on your own infrastructure, price that infrastructure and that time as part of the SD-WAN cost, not as general IT overhead.

The underlay: circuits are a separate bill

SD-WAN is an overlay. It steers traffic across circuits you still buy from carriers, on carrier contracts, and the overlay does not change what those circuits cost. Any saving comes from changing the underlay: replacing or shrinking private MPLS circuits with broadband or dedicated internet access (DIA), or adding a cheaper second path.

Whether that saving exists depends on your sites. Business internet at the bandwidth you need may not be cheaper than your existing MPLS in every metro, and rural sites can come with installation or construction charges that change the arithmetic. Static IP addresses, SLA-backed DIA and LTE or 5G backup are separate lines. TeleGeography's pricing analysis points out that local access can make up a large share of a DIA circuit's cost at a site, and access is the part that changes from one location to the next.

Check the end date of your current carrier contract. If the MPLS term runs for another year when the SD-WAN overlay goes live, you pay for both networks until it ends. Miss the renewal window and you may be committed to another term.

Managed SD-WAN and SASE bundles: what moves into the monthly fee

A managed SD-WAN quote replaces several lines with one monthly figure per site, which makes it hard to compare with anything else. Before comparing a managed offer with a do-it-yourself build, find out what the monthly fee includes: circuits or not, hardware ownership, monitoring, change requests, onsite support, security operations and the license tier underneath. Ask whether billing starts at contract signature or at site activation, because those are not always the same date.

SASE and security service edge (SSE) subscriptions are often priced alongside SD-WAN, and sometimes stacked on top of it. If the SD-WAN tier already includes branch firewall features and you also buy cloud security, you may be paying for inspection twice. If you drop the branch firewall because the SD-WAN edge is described as "secure," check that the security features you relied on are in the tier you are buying.

When SD-WAN does not save money over MPLS

SD-WAN cost is justified when the overlay lets you change the underlay: fewer or smaller private circuits, cheaper internet circuits, a second path at sites that had one, and faster turn-up of new sites. A business case usually falls short in one of three ways.

The first is keeping MPLS and adding SD-WAN on top, which adds a bill instead of replacing one. The second is that the private circuits were already competitively priced. Kam Agahian argued on Packet Pushers as early as 2019 that competition was "rapidly shrinking the gap in pricing" between MPLS and DIA, and advised buyers to push their carriers harder "by putting a few competing offers on the table" before funding an overlay. The third is that licenses, a security subscription, new hardware and the dual-running period consume the circuit saving.

Read published savings claims the way you read price ranges. TeleGeography's often-quoted 2020 analysis of whether SD-WAN can cut network spend in half was built on a hypothetical network, and its author tells readers who take a more conservative approach that they "may not see the dramatic savings that were demonstrated here." If a lower total is part of your business case, prove it with your own circuit quotes.

Renewal, co-term and exit: the costs after year one

The costs that are hardest to see at signature arrive at renewal. Renewal price is a new negotiation, and initial discounts are not guaranteed to carry into the renewal unless the contract says so, so ask for renewal pricing in writing before you sign.

Co-termination rules differ by vendor. Outside an Enterprise Agreement, Cisco allows a new DNA subscription to co-term with an existing one only if it meets the three-year minimum, and enrollment in an Enterprise Agreement carries a minimum total contract value, according to Cisco's FAQ. Meraki averages every license into one organization-wide date, so partial refreshes and additions move the date for everything.

Expiry also has operational consequences. Cisco states that if a Catalyst SD-WAN subscription expires without renewal, WAN management functions will no longer operate. Meraki devices shut down after the 30-day grace period.

Leaving is hard. Ivan Pepelnjak pointed out in 2019 on ipSpace.net that most SD-WAN products "use proprietary protocols, resulting in a perfect lock-in." Moving to another vendor usually means building a parallel network and migrating site by site. License ownership does not always cover operations either. In a dispute reported by Channel Dive in September 2026, managed service provider TPx says Arista is withholding VeloCloud updates and administrative tools it had paid for, while Arista says that payment covered limited support and license conversion, and that upgrades and hosted orchestration require a subscription. However that dispute ends, check your own contract for what keeps working, and who provides orchestration, if you stop paying for a subscription.

SD-WAN cost worksheet: compare quotes line by line

A calculator that returns one number hides the lines that differ between quotes. Put each quote in its own column, normalize every quote to the same term (for example five years) and the same site count, and write "not included" rather than leaving a cell blank.

Test before you sign: what a lab can and cannot tell you

"Test before you buy" covers three different tests, and a lab is only the first.

The first is a lab test of the design. Build the topology and policy you intend to deploy, then break it. Measure failover and failback separately, because a path that fails over cleanly does not always return cleanly. Test voice and SIP under impairment, application classification and steering, zero-touch provisioning, management access when the overlay is down, and how the edge inserts into your existing LAN, firewall and VRF design. Agahian's 2019 advice from the same Packet Pushers piece still holds: "investigations on paper are not enough; test per application." A lab is also where you find out whether your design needs features from a higher license tier, such as more segments or analytics, before the tier is written into a multi-year order.

The second is a pilot on real sites and real circuits. Two sites on the connections you would actually buy show last-mile quality and how your carrier handles tickets, which no lab can.

The third is a contract review covering renewal pricing, co-term arithmetic, what stops working at expiry and what exit costs. The pilot and the contract tell you what SD-WAN will cost. The lab tells you whether the design works and which tier it needs.

You have several ways to run the lab stage. Vendors run proof-of-concept programs, though not every vendor offers one for every deal. You can build your own lab in EVE-NG or Cisco Modeling Labs if you have the hardware to run the controllers, which are resource-hungry; our comparison of EVE-NG and CML covers the trade-offs. An integrator may run one for you. CloudMyLab offers two hosted routes. For Cisco, a pre-built Cisco SD-WAN lab comes with the control plane licensed and no policy configured, so you start from your own design. For other vendors, a custom proof-of-concept lab runs on vendor-agnostic infrastructure, and you supply the vendor images and licenses you are evaluating.

Conclusion

Budget SD-WAN as a stack of costs. Vendors meter the license differently, by device, bandwidth tier, site or security bundle, and the metric decides what happens when sites grow, traffic breaks out locally or one site needs a feature from a higher tier. The circuits underneath are a separate carrier bill that SD-WAN does not reduce, and the renewal is still a negotiation. Put every quote into the same worksheet, test the design before the tier is fixed in a multi-year order, pilot the circuits, and read the contract for what happens at expiry.

If you want to validate a design before you sign, CloudMyLab can host a proof-of-concept environment for your evaluation, or build and manage a test environment for you through Lab-as-a-Service.

Last verified: September 30, 2026. Vendor licensing changes often; check the linked vendor pages before you rely on a tier name or term.

FAQ

Is SD-WAN cheaper than MPLS?

Not automatically. SD-WAN is an overlay, so any saving comes from changing the circuits underneath: replacing or shrinking MPLS with broadband or dedicated internet access. If you keep MPLS and add SD-WAN, it is an additional cost. Whether internet circuits are cheaper depends on your locations, the bandwidth you need and your current MPLS contract.

How is SD-WAN licensed?

Vendors license SD-WAN per device, per bandwidth tier, per site, or as part of a firewall or security subscription. Cisco Catalyst SD-WAN uses DNA Essentials or Advantage subscriptions on 3, 5 or 7-year terms with bandwidth tiers. Meraki uses per-appliance MX licenses, Fortinet includes basic SD-WAN in FortiGate, and Palo Alto Prisma SD-WAN offers 1 to 5-year subscriptions.

Does SD-WAN require new hardware?

Usually, yes. Each site needs an SD-WAN edge, either a physical appliance or a virtual appliance running on your own compute or in a public cloud. Some existing routers and firewalls can run SD-WAN software if the vendor supports the model. High-availability sites need a second edge, and hub sites need their own.

What is usually missing from an SD-WAN quote?

The lines most often left out are high-availability edges and spares, hardware support, circuit installation and static IPs, security subscriptions, cloud compute and egress, integration work with your existing network, the months of paying for both old and new WANs, and renewal pricing. Normalize every quote to the same term and site count before comparing them.

How much does managed SD-WAN cost?

It depends on what the provider includes. A managed SD-WAN fee can cover the license, hardware, monitoring, change requests, onsite support, security and even circuits, or only some of them. Ask for the included services line by line, the license tier underneath, and when billing starts, then compare it with the same items in a do-it-yourself quote.