The Modern Network Playbook: what an SD-WAN provider in Minnesota should build

Why your multi-location network in Minneapolis is still wired for headquarters

Picture a company with a plant in Greater Minnesota, an office off I-494 and a dozen people working from home. Every Teams call from the plant travels to headquarters, out to Microsoft and back the same way. The new branch has been running on hotspots for three months while the carrier builds a circuit. And the day the fiber on the street gets cut, the phones go with it, because the backup connection was in the same trench. None of that is anyone's fault. The network was designed when applications lived in the server room. An SD-WAN provider in Minnesota exists to redesign it for where the work actually happens now.

For twenty years MPLS was the safe answer for connecting offices. It is still reliable. It is also expensive, slow to change and blind to the cloud, which is where your applications went. This article explains what SD-WAN replaces and what it does not, how application aware routing keeps calls clear, a failover design you can draw on a napkin, and the security layers that have to ride along. It is how the SD-WAN practice at Solution Builders designs every multi-site network, and it pairs with our IT director's guide to supporting multiple locations.

MPLS vs SD-WAN, decoded in plain language

MPLS is a private circuit from one carrier, priced by the megabit and built to haul everything back to headquarters. SD-WAN is software on top of any circuits you choose. It measures them constantly and sends each application down the best one. MPLS connects offices. SD-WAN connects your business, including the parts that live in Microsoft 365, Azure and your people's living rooms.

Three things SD-WAN does not do, because the sales decks tend to skip them.

• It does not make bad circuits good. It routes around them. Two weak links are still two weak links.
• It does not replace security. It carries it. The last section covers what has to ride along.
• It does not require ripping out MPLS on day one. Most firms run both for a quarter, then let the contract lapse.

The decision usually sorts itself by contract. If the MPLS term ends within 12 months, replace: design now and cut over as it lapses. If a multi year term remains, blend: add SD-WAN on top and shed MPLS later. A plant or clinic with latency sensitive gear keeps the private circuit where it is proven. And a site running on hotspots or consumer gear has nothing to protect, only something to fix. The question is no longer whether to leave MPLS. It is what you keep paying for while you decide.

The real cost of MPLS is the wait, not the invoice

The per megabit premium is easy to see on the bill. Harder to see is the new office that ran on hotspots for a quarter, the acquisition that waited 90 days for a circuit, and the calls that cross the state twice to reach the next town. A network refresh for growing companies is really a decision about how fast the business is allowed to move. In our planning models for an eight site company, SD-WAN over fiber and broadband runs about 78% of the MPLS cost in year one, with edge devices and migration included, and about 58% in years two and three. The savings are real. They are not the point.

1. Weeks 1 to 2: discoverInventory circuits, contracts, sites, applications and real traffic. Most companies find circuits they forgot they pay for.
2. Weeks 3 to 4: designPick transports per site, write application policies in business terms, size the edge devices.
3. Weeks 5 to 6: pilotTwo sites run SD-WAN beside MPLS. Measure call quality, failover and user experience against the old network.
4. Weeks 7 to 10: roll outA site or two per day. Local internet breakout turns on as each one cuts over.
5. Weeks 11 to 12: retireMPLS circuits come off as contracts allow. Savings start that month.

How application aware routing keeps calls clear

Old networks treat every packet the same and send it down one path until that path dies. Application aware routing knows a payroll upload from a video call, measures every circuit every second, and steers each application in real time. The thresholds are not mysterious. ITU recommendation G.114 puts the one way delay ceiling for natural sounding voice at 150 milliseconds, and Cisco's quality of service guidance holds real time traffic to under 1% packet loss and under 30 milliseconds of jitter. Four things happen to every new session, in a few milliseconds.

1. IdentifyThe edge recognizes the application by its signature, not its port. Teams is Teams, not "encrypted web traffic."
2. MeasureTiny probe packets cross every circuit continuously, scoring each one for latency, loss, jitter and availability.
3. DecideEach application class has a policy: what quality it needs, which paths it may use, what it gets when things degrade.
4. SteerThe session lands on the best qualifying path. If that path slips below threshold, it moves, mid call, without a drop.

On a Tuesday morning at 10:30 a carrier issue pushes latency on the fiber circuit from 20 milliseconds past 100. Voice and video move to the cable circuit automatically, spend 40 minutes there, and move back when fiber recovers. What the user experiences is nothing. Old networks fail over when a cable dies. Modern ones fail over when a call starts to sound bad. The payoff is a policy you can read aloud at a leadership meeting. Five classes cover almost every company we see.

Reserve bandwidth for voice and video before anything else gets a byte. A single Windows update at the wrong moment has ruined more sales calls than any carrier outage.

Redundancy is not two cables into the same hole

Every multi-site business has a story about the day the internet died and the phones went with it. Most of them had a backup circuit. It was in the same conduit, from the same carrier, plugged into the same router, and nobody had tested it. The ITIC 2024 Hourly Cost of Downtime Survey found more than 90% of midsize and large enterprises put one hour of downtime above $300,000. Networks rarely fail in interesting ways. They fail in the same five ways, over and over.

• Same conduit. Two circuits from two carriers, one trench into the building. A backhoe takes both. Ask for diverse entry or add wireless.
• Same carrier underneath. Your second provider resells the first one's last mile. Ask who owns the fiber, not who bills you.
• Single edge device. Two circuits into one router or firewall. When it reboots, so does the site.
• No power plan. The modem is not on the UPS, or the UPS died two years ago. Minnesota ice storms find this one every winter.
• Failover never tested. Configured in 2021, changed six times since. Pull the primary cable twice a year, on purpose, during business hours.

For every site, ask the backhoe question: if a backhoe cuts the fiber on the street, what still works? If the answer involves someone driving over with a hotspot, you have one circuit. At a well designed site the first minute after a cut goes like this: probes stop returning and the edge marks the path down at zero seconds, live calls move to cable or LTE in under a second with no drop, everything else follows within five seconds, and at one minute a human in the operations center opens a carrier ticket. When fiber returns, traffic fails back after a clean quality window.

• Two carriers, two physical entries, verified by asking who owns the last mile.
• Cellular, LTE or 5G, as a third path at every site that takes phone calls.
• Paired edge devices at headquarters and at any site with more than 25 people.
• Local internet breakout at every site, so no branch depends on headquarters being up.
• Everything in the path on protected power: modems, edges, switches, phones.
• A documented failover test, run twice a year, with results sent to leadership.

An 85 user manufacturer in Greater Minnesota that Solution Builders rebuilt this way eliminated more than 100 hours of monthly downtime within 90 days, and support tickets fell 60% once the network stopped flapping. Site designs like that are delivered by our professional services engineers, with sub second failover written into the contract rather than hoped for.

Security belongs in the path, not at the perimeter

The old model put a firewall at the edge of each office and a VPN in front of remote staff. Attackers noticed. The Verizon 2024 Data Breach Investigations Report measured 180% year over year growth in breaches that began with an exploited vulnerability, and Mandiant's M-Trends 2024 found 38% of the intrusions it investigated started with an exploit, the top initial access vector. A VPN appliance is a door on the internet with a password, and whoever holds the password is inside. Five layers turn a wide area network into part of your defense. Gartner named the combination SASE, secure access service edge, in 2019: one policy, every site, every user.

Do it in this order. Segment first, because separating guest, IoT and plant equipment from staff devices is mostly configuration, takes days and limits every breach that follows. Retire the VPN application by application, starting with email and the ERP. Move inspection to the cloud so a user in a coffee shop gets the same protection as one at headquarters. Then feed every edge, every segment and every denied connection to a security operations center staffed around the clock, so the network becomes a sensor, not just a pipe. The best firewall is a network where a stolen laptop password gets an attacker exactly one application, and a very loud alert.

What to do this week

Three moves, in order. Two of them are questions, not purchases.

1. Ask the backhoe question at every siteWho owns the last mile on each circuit, where does it enter the building, and what still works if the street gets dug up? Write the answers down. One circuit disguised as two is the most common finding.
2. Pull the plug on purposePick a quiet hour, unplug the primary circuit at one site and watch what happens to a live Teams call. If it drops, you have your first project.
3. Get an outside readA Network Readiness Snapshot with Solution Builders is a free 30 minute conversation about your sites, circuits and contracts. You leave with a candid read and the three things to fix first. Book a time or call (952) 854 8188.

Business network services in the Twin Cities should mean a network that is managed, not just installed: circuits, edges, policy, failover testing, security and 24/7 monitoring as one service. That is the I in the RISE framework, Integrated, and it is the foundation the rest of the letters stand on.