State of Managed SD-WAN, SASE: VMware Portfolio Changes Cast a Heavy Shadow

Channel marketers and journalists frequently use the terms SD-WAN and SASE, but how have those acronyms translated to the end customer?

Kirk Armstrong consults on SD-WAN and SASE as chief technology officer at Eclipse. He said he sometimes hears customers utter the term "SD-WAN" when they are actually referring to a broader solution.

Eclipse's Kirk Armstrong

"SD-WAN is a segment of SASE framework, so depending on who you are talking to within the clients, you may have some where SASE is becoming a conscious topic. But SD-WAN is what we are seeing customers refer to network transformation as even if it is more segments of SASE framework than SD-WAN," he said.

But managed SD-WAN services exist in nearly all of Eclipses network transformation projects, Armstrong said.

"... because clients tend to view this as a critical but commodity service saying we want someone to manage that the network is up and available while our team focuses on items that are unique to our business that we cannot easily outsource," Armstrong said.

The undeniable trend in managed SD-WAN providers shared is SASE. Namely, they report that businesses wish to converge their cybersecurity and networking features into the same platform.

"Clearly there is a trend and preference for customers to combine SD-WAN and firewall security in one box vs. two," Spectrotel CEO Ross Artale told Channel Futures.

The reasons vary. One is simplicity and consolidation of the aforementioned vendor sprawl.

AireSpring's Ellen Cahill

"Customers are seeking a single-source plug-and-play solution for SD-WAN with integrated security," said Ellen Cahill, senior vice president of marketing for AireSpring.

Cato Networks, whom AireSpring and Spectrotel both leverage for SASE, reports that networking and cybersecurity teams are merging with each other. That might lead them to want to buy a single solution together, rather than purchase on their own.

Cahill said vendors that started with security – she pointed to Fortinet and Cato – have the advantage when it comes to single-source SASE.

Cahill said reliable and flexible security operations (SOC) center will be key for service providers going forward as they lean more into security.

Aryaka's Renuka Nadkarni

Aryaka Networks chief product officer Renuka Nadkarni said Aryaka is picking up business with companies that want to exit appliance-based solutions from disparate providers, and instead adopt an "as-a-service, cloud-based approach."

"As SASE gets to the next phase of maturity, most customers are looking to move away from individually managed and distributed appliances to a more unified as-a-service experience," Nadkarni said.

Mauricio Sanchez, senior research director at Dell'Oro Group said he's curious of what revenue drivers are leading telecom service providers to lean into SSE and SASE.

Dell'Oro's Mauricio Sanchez

"We all know margins in service provider land are slim and many SD-WAN solutions being a step up in pricing over traditional routing solutions... has made life in contemporary SD-WAN landscape more difficult. SASE/Security has become that for some carriers, but the more savvy ones have started to monetize security and this has provided the opportunity to raise the per customer revenue," Sanchez told Channel Futures.

How are different business segments and verticals experiencing SD-WAN and SASE? Are certain vendors winning in certain areas?

BCN Telecom president and chief operating officer Julian Jacquez said it's important to include multiple vendors in an SD-WAN portfolio due to the diverse requirements of customers.

But those different requirements don't necessarily boil down to verticals or segments, Jacquez said.

"With SD-WAN, the segmentation we see is really a ‘customer needs segmentation’ driven by what they are trying to accomplish, vs. a traditional vertical or SIC code," he told Channel Futures. "For example, Peplink is the router of choice for BCN inside our open enclosure POTS Over LTE solution because of its built-in SD-WAN capability which enables an active-active call."

BCN's Julian Jacquez

Trends have emerged in certain verticals for BCN, such as Bigleaf Networks winning with automotive and healthcare customers. But Jacquez said customer discovery questions will ultimately decide the solution.

"Questions include things like the number and types of connections needed, firewall requirements, site to site connectivity and remote users access," he said.

Robert DeVita, whose IT consulting firm Mejeticks sources managed SD-WAN and SASE, noted a few vendors that are distinguishing themselves in certain categories.

"We see large enterprises looking more at [VMware] VeloCloud due to their global network and cloud gateways. We are seeing retail customers looking more at Fortinet due to security and price point," DeVita said. "Customers who want to manage their own network continue to rely on Cisco-based technologies, either from a comfort level or the inability to correctly vet the entire market for a different solution."

Expereo designs and manages SD-WAN for multinational customers who require high customization.

Expereo's Sander Barens

"Our approach to SD-WAN design is ensuring the best technology fit for the complexity of the network, combined with the geographical footprint and of course, the appropriate budget. As such each vendor in our mix has a strategic role, enabling our solution engineers to have access to the right technologies they need..." Expereo chief product officer Sander Barens said. "We expect from our technology vendors that they understand the importance of quality, communication, and commercial competition. To win and serve is a partnership."

Few companies hold a more pioneering status in the decade-old world of SD-WAN than VeloCloud, which VMware purchased in 2017. VeloCloud racked up dozens of partnerships with service providers, who used its technology as their entrance into providing managed SD-WAN. They weren't alone in the market, with Viptela (acquired by Cisco in 2017), Versa Networks and other SD-WAN "pure-plays" vendors finding traction among service providers.

The burgeoning market saw mass consolidation in the years leading up and through the pandemic. Oracle bought Talari, Palo Alto Networks bought CloudGenix and HPE Aruba bought Silver Peak. Gartner rolled out the term "SASE" in 2019, forecasting the integration of SD-WAN and advanced cybersecurity features on the same cloud-based platform just in time for the mass movement to remote and hybrid workforces that occurred the next year.

If most service providers were only using one or two underlying SD-WAN vendors in 2016, that seems like the outlier strategy in 2024.

BCN, for example, touts four SD-WAN and SASE vendors in its portfolio. Those partnerships came into play after BCN originally leveraged VMware VeloCloud. And one of those new vendors ended up filling the need VMware previously met.

"In 2023 we elected to reposition our VMWare customers more appropriately with one of our other available solutions. We found that Bigleaf Networks was a great match for the requirements of these VMware customers, and in the end, most of them when to Bigleaf with success," Jacquez.

How are these service providers feeling the impact Broadcom buying VMware?

Back in December, a VMware partner enablement source told Channel Futures that serious layoffs had come to VMware's edge networking business. Cuts that specifically that would reduce go-to-market support VMware was giving to its SD-WAN service partners. Market development funds (MDF) were also mentioned as possible casulaties.

“My feeling is they're just going to milk the revenue stream," the source said. "These companies won't automatically shut off, but they'll slowly start focusing on the other vendors because they're not getting the help anymore."

Since that report, most service providers queried by Channel Futures have emphasized that they are taking a wait-and-see approach. And now many are still saying that nothing tumultuous has happened yet.

Artale said Spectrotel has seen the same support.

"So far, our account manager (wholesale and nationwide) continues to be there to support us, but they are transitioning between systems and we’ll see how that plays out," Artale told Channel Futures.

One service provider with a deep VeloCloud base, however, said changes to products and systems have caused major disruption. Certain VeloCloud SKUs went away "without advanced notice." That, as well as a system changed that left customers unable to open trouble tickets, have caused the partner significant concern.

"We are not the only MSSP who is experiencing this pain. To discontinue SKUs overnite is painful for MSSPs and their customers," the partner said. "We have SLAs where we will replace their VeloCloud appliances overnight if they fail. If the SKUs are eliminated that changes everything. Also God forbid there are supply chain issues again like we saw during Covid."

Armstrong said future license cost uncertainty is a key topic for customers.

"The worst kept secret with VeloCloud is that the gateways licenses are not audited against actual usage of the gateways. With Broadcom now being the parent company, it is not that far of a stretch to say that those are going to be more closely monitored and managed by the VeloCloud team," Armstrong said.

Broadcom announced Feb. 26 that its newly rechristened VMware VeloCloud SASE Solution would contain SSE from Symantec. Broadcom acquired Symantec's enterprise business in 2019.

The solution became immediately available to more than 80,000 customers who were already deploying either VeloCloud or Symantec.

VMware has completed many acquisitions in order to hold all the different components of a SASE solution, with some acquisitions sticking and others not. One partner said VMware will need to deeply integrate Symantec into its SASE solution to compete with vendors that haven't had to do as much M&A in the past.

Armstrong said the integration of Symantec would be a "long-term powerful solution." But the bigger question is how long it will take for the platforms to integrate, and how effectively they will integrate, he said.

"For a long time VeloCloud was the default decision in many router replacement SD-WAN scenarios, and clients would start adding, their Palo Alto, Fortinet, ZScaler, Netskope, or Prisma to the deployment for security. Having a total SASE solution in one place with VeloCloud could bring them back to the forefront of network transformation conversations that in the last few years have trended towards the Fortinet, Meraki, Palo Altos of the world," he said.

Broadcom announced Feb. 26 that its newly rechristened VMware VeloCloud SASE Solution would contain SSE from Symantec. Broadcom acquired Symantec's enterprise business in 2019.

The solution became immediately available to more than 80,000 customers who were already deploying either VeloCloud or Symantec.

VMware has completed many acquisitions in order to hold all the different components of a SASE solution, with some acquisitions sticking and others not. One partner said VMware will need to deeply integrate Symantec into its SASE solution to compete with vendors that haven't had to do as much M&A in the past.

Armstrong said the integration of Symantec would be a "long-term powerful solution." But the bigger question is how long it will take for the platforms to integrate, and how effectively they will integrate, he said.

"For a long time VeloCloud was the default decision in many router replacement SD-WAN scenarios, and clients would start adding, their Palo Alto, Fortinet, ZScaler, Netskope, or Prisma to the deployment for security. Having a total SASE solution in one place with VeloCloud could bring them back to the forefront of network transformation conversations that in the last few years have trended towards the Fortinet, Meraki, Palo Altos of the world," he said.