SD-WAN Deployment for Multi-Branch Enterprises

SD-WAN abstracts the underlying transport (MPLS, broadband, LTE) and applies application-aware routing policies.

SD-WAN vs Traditional WAN

Aspect	Traditional MPLS	SD-WAN
Cost	High	Low (uses internet)
Provisioning	Weeks	Hours
Application awareness	None	Full
Failover	Minutes	Sub-second
Centralized management	Limited	Full

MikroTik-Based SD-WAN Architecture

Using MikroTik with Policy-Based Routing (PBR) as a cost-effective SD-WAN alternative:

BASH

# WAN interfaces
/interface set ether1 comment="ISP1-Primary"
/interface set ether2 comment="ISP2-Backup"
/interface set lte1 comment="LTE-Failover"

# Routing tables
/routing table add name=via-isp1 fib
/routing table add name=via-isp2 fib
/routing table add name=via-lte fib

# Default routes per table
/ip route add dst-address=0.0.0.0/0 gateway=203.0.113.1 routing-table=via-isp1
/ip route add dst-address=0.0.0.0/0 gateway=198.51.100.1 routing-table=via-isp2
/ip route add dst-address=0.0.0.0/0 gateway=lte1 routing-table=via-lte

Application-Based Routing

BASH

# VoIP via ISP1 (low latency)
/ip firewall mangle add chain=prerouting protocol=udp dst-port=10000-20000 action=mark-routing new-routing-mark=via-isp1

# Backup/bulk traffic via ISP2 (cheaper)
/ip firewall mangle add chain=prerouting dst-address-list=backup-servers action=mark-routing new-routing-mark=via-isp2

# All other traffic via ISP1 with ISP2 fallback
/ip route add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=1
/ip route add dst-address=0.0.0.0/0 gateway=198.51.100.1 distance=2

Link Health Monitoring

BASH

/ip route check-gateway=ping
/ip route add dst-address=0.0.0.0/0 gateway=203.0.113.1 check-gateway=ping distance=1
/ip route add dst-address=0.0.0.0/0 gateway=198.51.100.1 check-gateway=ping distance=2

WAN Failover Testing

BASH

# Simulate ISP1 failure
/interface disable ether1

# Verify traffic routes via ISP2
/ip route print where active

# Re-enable
/interface enable ether1

Centralized Management with Dude/Zabbix

Monitor all SD-WAN nodes centrally: track WAN link states, latency per link, failover events, and application performance.