SD-WAN, SaaS Breakout, and an MPLS Contract

Put an SD-WAN edge at each branch with three transports: MPLS, broadband, and LTE. Use application-aware routing with probes to Microsoft 365 and Salesforce, and send SaaS traffic directly to the local broadband breakout through a cloud security point of presence or SASE gateway. That removes the hairpin to HQ and should cut the 300 ms latency. Keep PCI payment traffic on MPLS, or on broadband only through an encrypted, compliant overlay with the same firewall and logging policy; PCI does not automatically require MPLS, but it does require a controlled, documented path. Keep latency-sensitive voice on MPLS if the broadband SLA cannot support it; otherwise use broadband with active probes and fail over to LTE only for survivability, not for long calls. Guest Wi-Fi stays on a separate VPN and local breakout. Bulk backup and software updates can use broadband with a scavenger class. The policy should be expressed as an application matrix, not a static route, because the goal is to choose the best path per application and per SLA.

Use separate VRFs or VPN segments for PCI, corporate, and guest. The branch SD-WAN edge advertises only the branch LAN into the overlay, not into the MPLS provider or the internet. For PCI, prefer a single active path at a time; if both MPLS and broadband are available, use policy-based forwarding with health probes and stickiness so the forward and return traffic use the same edge. Avoid redistributing internet routes into MPLS or MPLS routes into the internet. NAT the branch broadband to a public address pool at the edge or at the SASE gateway, and do not allow inbound unsolicited traffic. For PCI, inspect traffic at the SASE/firewall, log flows, and restrict the payment gateway to TCP 443 and required DNS/NTP. If PCI traffic traverses the internet, encrypt it with IPsec and apply the same ACLs as the MPLS path. Ensure the cloud on-ramp at HQ is used for data-center-to-cloud traffic, while branch SaaS uses local breakout, so the two paths do not compete or loop.

Do not try to cancel the contract immediately. Right-size it instead: keep enough MPLS bandwidth for PCI and voice at each branch, and move SaaS, guest, and bulk traffic to broadband. Use the 18 months to negotiate a migration credit or early-termination schedule, and ask for a lower committed rate at renewal. Migrate in phases: pilot five branches with the SD-WAN edge in parallel with the existing router, measure SaaS latency, voice MOS, and PCI flow symmetry, then roll out in waves. Keep the MPLS router as a fallback until the pilot is stable. During cutover, use a prebuilt rollback that restores the old default route and NAT in under 15 minutes. For payments, run both paths in monitor mode first and compare firewall session tables; do not enable active/active PCI across MPLS and broadband unless the firewall can handle asymmetry or the SD-WAN policy guarantees stickiness. Document the contract end date and the exit criteria for each wave so the CIO can see savings without risking compliance.