Most companies moving to managed SD-WAN already own firewalls they trust, with years of policy built into them. The good news is that you don’t have to rip them out. Managed SD-WAN can sit in front of, behind or alongside your existing firewall stack, as long as you plan the routing, security zones and failover before the first site goes live.
- There are three common patterns: SD-WAN behind the firewall, SD-WAN in front of it, or the SD-WAN edge and firewall side by side with traffic steered between them.
- Decide early whether you’ll keep your firewall at every branch, use the SD-WAN device’s built-in security, or send traffic to a cloud security service (SASE).
- Map routing, zones and segments before deployment so traffic doesn’t bypass inspection or take asymmetric paths.
- Agree with your managed provider on who owns which policies, logs and changes.
- Pilot at one or two sites, test failover, then roll out in waves.
Why the firewall question matters
SD-WAN changes how traffic leaves each site. Instead of sending everything back to a data center over MPLS, branches can break out to the internet locally over broadband, fiber or wireless links. That’s faster and often cheaper, but it also means every site now has a direct path to the internet, and every path needs to be inspected.
The edge is also where attackers are focusing. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the most common initial access vector for breaches, and the median time to fully patch a known exploited vulnerability rose to 43 days. In Sophos’ State of Ransomware 2026 survey, 59% of ransom demands from attacks that started with an exploited vulnerability on the firewall were $1 million or more. CISA’s guidance on protecting network edge devices covers firewalls, routers and VPN gateways for the same reason.
Adding SD-WAN appliances adds edge devices. Connecting them to your firewall stack cleanly keeps your attack surface from growing along with your network.
Three ways to connect managed SD-WAN to your firewalls
1. SD-WAN behind the firewall
The firewall stays at the internet edge and the SD-WAN device sits on the inside. The firewall handles NAT and inspection, and the SD-WAN overlay tunnels pass through it. This keeps your existing security policy intact and is often the easiest place to start. The tradeoffs: you need to allow the SD-WAN tunnel traffic through the firewall, and the firewall’s throughput can become the limit as you add bandwidth.
2. SD-WAN in front of the firewall
The SD-WAN device terminates the internet circuits and steers traffic, then hands it to the firewall on the inside for inspection. This gives SD-WAN direct control over link selection and quality, which helps voice and video. You’ll want to harden the SD-WAN device as an internet-facing system, keep its management plane off the public internet, and make sure nothing reaches internal networks without passing through the firewall.
3. Side by side, with traffic steering
Both devices connect to the internet and the LAN, and routing or policy decides which traffic goes where. For example, trusted SaaS traffic might break out through the SD-WAN path while general web traffic goes through the firewall. This is flexible but the most complex to manage, so it works best when you have clear segmentation and strong change control.
Keep, consolidate or move security to the cloud?
Many SD-WAN platforms include built-in firewall features, and many security services can now be delivered from the cloud. That leaves three broad options for each site:
| Option | When it fits | What to watch |
|---|---|---|
| Keep your existing firewalls | Recent hardware, mature policies, a team that knows the platform | Throughput limits, lifecycle dates, two management consoles |
| Use the SD-WAN device’s built-in security | Smaller branches, simpler policies, fewer boxes per site | Feature gaps vs. your current firewall, rewriting policy |
| Send traffic to a cloud security service (SASE) | Many sites, remote users, heavy SaaS use | Latency to the nearest point of presence, licensing, how on-site traffic is protected |
You don’t have to pick one model everywhere. A common approach is to keep full firewalls at headquarters and data centers, and use lighter options at small branches.
Step-by-step: connecting SD-WAN to your firewall stack
- Inventory what you have. List firewall models, software versions, support dates, throughput, licensed features and the policies at each site. Note which devices are close to end of support.
- Map your traffic. Identify which applications go to the data center, which go to SaaS or cloud, and which need priority, such as voice, video and payment systems.
- Pick a pattern per site type. Choose behind, in front or side by side for headquarters, data centers and branches. Keep the number of designs small.
- Design routing and segmentation. Plan how overlay routes, VRFs or segments line up with firewall zones. Avoid asymmetric routing, where traffic leaves through one device and returns through another, because stateful firewalls will often drop it.
- Align security policy. Decide where each rule lives. Map firewall zones to SD-WAN segments so a guest network on one device is still a guest network on the other.
- Plan high availability and failover. Decide how each site behaves if a circuit, the SD-WAN device or the firewall fails. Make sure failover paths are inspected too.
- Connect logging and monitoring. Send logs from both platforms to the same SIEM or monitoring service so your security team sees the full picture.
- Agree on ownership. With a managed SD-WAN service, write down who changes what. Your provider may manage the overlay while your team or a separate provider manages firewall policy.
- Pilot, test, then roll out. Start with one or two representative sites. Test application performance, failover and policy enforcement before scheduling waves.
Common mistakes to avoid
- Local internet breakout that skips inspection. Direct internet access is a major SD-WAN benefit, but it needs a security path at every site.
- Exposed management interfaces. Keep admin access to firewalls and SD-WAN devices off the public internet and protected with MFA.
- Patching only one platform. Firewalls and SD-WAN appliances both need regular updates. Ask your managed provider how quickly they apply security patches.
- Unclear responsibility. When an application breaks, you need to know whether to call the SD-WAN provider, the firewall team or the carrier.
- Forgetting the circuits. SD-WAN works best with diverse connections. Check that your backup link doesn’t share the same path or carrier as your primary.
How LAVA helps
LAVA is a technology advisor. We work with 100+ connectivity providers and 60+ SASE providers, across SD-WAN, MPLS, dedicated internet and managed security. Our solution architects look at your current firewalls, circuits and sites, help you choose an integration pattern, and source and compare managed SD-WAN options that fit. If you’re also reviewing what you pay for circuits, our Network Spend Optimization (NSO) service can help. Learn more on our network and connectivity and security pages.
FAQ
Do I need to replace my firewalls to use managed SD-WAN?
No. Most managed SD-WAN services can work with existing firewalls, either behind, in front of or alongside them. Replacement usually makes sense only when a firewall is near end of support or can’t handle the bandwidth.
Is SD-WAN’s built-in firewall enough?
For some small branches it can be. Compare its features, such as intrusion prevention, web filtering and logging, with what your policies require before relying on it alone.
What’s the difference between SD-WAN and SASE?
SD-WAN manages how traffic moves across your network links. SASE combines networking with cloud-delivered security services, such as secure web gateway and zero trust access, so inspection happens in the cloud instead of only on site.
What causes asymmetric routing with SD-WAN and firewalls?
It happens when outbound and return traffic take different paths, often after adding a second device or link. Stateful firewalls may drop the return traffic. Careful route design and consistent next hops prevent it.
How long does a managed SD-WAN rollout take?
It depends on the number of sites, circuit lead times and design complexity. Piloting first and rolling out in waves keeps the risk low.
Plan the connection before the cutover
Getting SD-WAN and your firewalls to work together is mostly a design question. Contact LAVA to review your sites and find the managed SD-WAN approach that fits your existing security stack.
