SD-WAN deployment models, zero-touch provisioning and choosing a vendor
In short: SD-WAN can be run in-house, shared with a partner, bought as a fully managed service or delivered from the cloud together with security. Zero-touch provisioning lets a non-technical person plug in an edge device that then builds its own tunnels from a central template. Choose a model by your team's skills, and choose a vendor by how well it fits your applications, security plans and exit options.
Four ways to deploy SD-WAN
| Model | How it works | Suits |
|---|---|---|
| Do it yourself | You buy edge devices and licences and run the controller (on-premises or vendor cloud) with your own staff | Organisations with a skilled network team that want full control |
| Co-managed | A partner builds and monitors the service; you can still change policies | Teams that want control of policy but not 24-hour monitoring |
| Fully managed | A provider supplies links, devices and operation as one service with an SLA | Small IT teams and organisations that prefer one supplier |
| Cloud-delivered | Controller, gateways and security run in the vendor's cloud; sites connect to the nearest point of presence | Cloud-first organisations heading towards SASE |
There is no best model. The right one depends on how many people you have, whether they work out of hours, and how much control you need.
Zero-touch provisioning
One of SD-WAN's most practical features is zero-touch provisioning (ZTP). Instead of an engineer travelling to every site, the process looks like this:
- The engineer creates the site in the controller and attaches a template: links, segments, policies and addresses.
- The device's serial number is registered to that site, often automatically from the purchase order.
- Someone at the site plugs the device into power and the internet line.
- The device gets a temporary address, contacts the vendor's onboarding service, proves its identity with a built-in certificate and is pointed at your controller.
- It downloads its configuration, builds encrypted tunnels to the other sites and reports in.
Because the device authenticates with a certificate, a stolen or unregistered box can't join your network. Still keep an inventory and remove devices from the controller when they are retired.
Typical use cases by sector
- Retail: many small sites, card payments and cloud stock systems; fast openings on 4G/5G.
- Healthcare: clinics reaching central records and imaging, with strict segmentation of medical devices.
- Education: schools sharing a central internet service and filtering, with heavy video and cloud learning platforms.
- Remote and hybrid work: small home-office edge devices or software clients for staff who need office-grade performance.
- Manufacturing and logistics: sites in remote areas with mixed links, where losing the WAN stops production.
Choosing a vendor without regret
- Application fit: does it recognise the applications you rely on, and does it protect voice and video well on poor links?
- Security: what firewall and web protection runs on the edge device, and does it integrate with a cloud security service if you plan SASE later?
- Scale and operations: how good are the templates, reporting and API? Can your team troubleshoot with it at 3 a.m.?
- Lock-in: overlays from different vendors don't interoperate, so you are choosing for years. Check contract length, licence terms and how you would migrate away.
- Proof: run a pilot at two or three real sites, including your worst link, before signing.
Tip: ask for the controller to be hosted in a region that meets your data protection rules, and find out what happens to the overlay if the controller is unreachable. Most designs keep forwarding traffic with the last known policy.
Real-world example: a school trust picks a model
A fictional trust of twelve schools had one network engineer and a part-time assistant. A do-it-yourself SD-WAN would have left nobody to watch it during holidays, so they chose a co-managed service: a partner monitors the overlay around the clock and handles faults, while the trust's engineer controls the web filtering and traffic policies. New schools joining the trust receive a pre-registered edge device by courier; the school business manager plugs it in, and it is online within the hour.
Practice
What problem does zero-touch provisioning solve?
Why might a small IT team choose a co-managed or fully managed SD-WAN?
Why should vendor lock-in be considered carefully with SD-WAN?
Key takeaways
- SD-WAN can be run in-house, co-managed, fully managed or delivered from the cloud.
- Choose a model by staff skills, out-of-hours cover and how much control you need.
- Zero-touch provisioning lets a device authenticate and configure itself from a template.
- Common uses include retail, healthcare, education, remote work and manufacturing.
- Pilot real sites and check security, operations and exit terms before choosing a vendor.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.