Connecting your sites: VPN, MPLS or SD-WAN — how to choose

As soon as a company has several sites — headquarters, branches, warehouses, remote work — the question of interconnecting them reliably and securely arises. Three main approaches coexist today: VPN, MPLS and SD-WAN. They aren't directly opposed; they meet different needs and budgets.

IPsec VPN: simple and universal

A site-to-site VPN encrypts traffic between your sites and carries it over the Internet. Its big advantage is cost and flexibility: it works on any Internet access. Its limitation comes from that same "best effort" Internet: quality (latency, jitter, loss) isn't guaranteed, which can hamper real-time applications. It's an excellent baseline for modest needs or secondary sites.

MPLS: guaranteed quality of service

An operator-run MPLS network creates a private network between your sites, with guaranteed quality of service (QoS) and strict traffic separation. It's the historical solution for demanding multi-site companies: controlled latency, voice and video prioritisation, strong contractual commitments. In return, it's generally more expensive and less flexible to evolve than an Internet-based solution.

SD-WAN: the best of both worlds?

SD-WAN (Software-Defined WAN) intelligently steers several links at once — fibre, Internet, 4G/5G, even MPLS — and routes each application over the best available path in real time. Its strengths:

• Resilience: automatic failover if a link degrades or drops.
• Application performance: video calls go over the most stable link, backups over the cheapest.
• Centralised operations: policies are managed from a single console, without reconfiguring each site.

It's currently the most flexible approach for multi-site networks — provided it's well designed and well monitored.

How to choose?

• Tight budget, simple needs: IPsec VPN over your existing access.
• Critical applications, contractual QoS: MPLS.
• Multi-site, multi-link, agility: SD-WAN, often combining several access types.

The real success factor is still the operator: the quality of the underlying network and the operations make all the difference. Our telecom offering covers site interconnection and access, backed by our network core and our IP transit. And our managed IT can handle its end-to-end design and monitoring.