Comparing the SD-WAN Licensing Needs of Major Vendors

By Gary Taylor, Solutions Architect

With more enterprises adopting SD-WAN technology, SD-WAN vendor support can be a key to success. We break down the licensing of eight major SD-WAN vendors.

Whichever SD-WAN vendor you use, the way you deploy is essential to success. When you use Megaport Virtual Edge (MVE), Megaport’s on-demand Network Functions Virtualization (NFV) service, you’ll get compute to host the VNF functionality you require, and Megaport Internet for the management access you need – so you can deploy SD-WAN gateways, virtual routers, and virtual firewalls in minutes.

But the different licensing approaches of different SD-WAN vendors will change exactly how you deploy, including with MVE.

Let’s review the licensing approaches of each of Megaport’s partner SD-WAN vendors.

Cisco SD-WAN

Cisco DNA Software for Catalyst SD-WAN comprises Cisco DNA Essentials and DNA Advantage, with Cisco DNA Premier license now discontinued.

In order to deploy Cisco SD-WAN using MVE, you can use the DNA Essentials license – although some features like “security” will need the DNA Advantage license. You can see Cisco’s full SD-WAN feature matrix here.

Cisco DNA licenses are categorized into network-stack licenses and DNA-stack add-on licenses. So for the Cisco 8000v Autonomous mode MVE, when you configure a network-stack license you will also need a corresponding DNA-stack add-on license.

It’s worth noting that if you just need routing functionality, then some features are only available within the DNA Advantage license (like “multicast”).

Existing Cisco customers would utilize their current DNA Advantage for installation of MVE. The terms for DNA Advantage are three, five, or seven years.

Please note the new Catalyst Routing Essentials license is only available on Cisco Catalyst 8200 and 8300 Platform Family devices, so isn’t applicable to MVE.

This Cisco guide provides a good overview of the SD-WAN and Routing nomenclature.

As a summary, if you wish to provision Cisco SD-WAN using Megaport, you simply choose the bandwidth needed, the term of the license, and which feature set is required between DNA Essentials and DNA Advantage.

The table below provides an overview of the throughput Mapping and Tiers for the Cisco 8000v platform. Throughput greater than 250 Mbps requires an HSECK9 license.

For more information, refer to the Cisco Catalyst 8000v edge software ordering guide.

How to deploy Cisco with MVE

For further details on how to deploy Megaport Virtual Edge using Cisco, visit our Docs Portal.

Fortinet Fortigate-VM

The Fortinet approach to FortiGate-VM licensing is simply based on the number of virtual CPUs configured in the applicable MVE service, as well as the relevant annual subscription licensing.

FortiGate-VM offers a perpetual licensing option (normal series and V-series) as well as an annual subscription option (S-series). Fortinet has also recently introduced a permanent trial mode with some limitations.

The SD-WAN components of FortiGate and FortiOS don’t need any additional licensing or bundles, but it’s still advised to procure the SD-WAN orchestrator license for easy deployment and management of your edge devices.

FortiOS does not have licensed RAM size restrictions and the entry level MVE includes 8 GB of RAM, so well above the recommended minimum of 2 GB RAM.

From an ordering point of view, you can choose:

• À la carte
• Advanced Threat Protection (ATP)
• Unified Threat Protection (UTP)
• Enterprise Protection (EP)

ATP, UTP, and EP are bundles and include Forticare Premium Technical Support. Find more info on Fortigate Subscriptions and Bundles here.

For example, for a small MVE with 2 vCPUs, your options would be FG-VM02, FG-VM02V, or FG-VM02S.

The “V” suffix means no virtual domains (VDOMs) by default, and the “S” suffix means it’s a subscription-based license. If a license has no letter at the end, it’s a perpetual license.

For the perpetual or “V” license option, you would then choose the applicable additional security features like Intrusion Prevention System (IPS), antivirus, sandboxing, and others if required.

How to deploy Fortinet Fortigate with MVE

For further details on how to deploy Megaport Virtual Edge using Fortinet Fortigate, visit our Docs Portal.

Versa Secure SD-WAN

Versa offers licenses based on feature set requirements, as well as the bandwidth that the specific device is allowed to consume. Each Versa Operating System (VOS) device that you deploy as customer-premises equipment (CPE) is associated with a license.

Like all vendors, the feature set on offer depends on the specific solution tier with more features increasing the cost of the license.

The breakdown is as follows, with each tier being cumulative:

• Pro Net: Basic and advanced routing features, which are Layer 2 bridging, carrier-class Layer 3 routing, bridging, Layer 4 security, uCPE, and ZTP.
• Prime SD-WAN: All Pro Net tier features plus SD-WAN connectivity, application identification (App ID), application policy-based forwarding, and traffic engineering.
• Prime Secure SD-WAN: All Prime SD-WAN tier features plus next-generation firewall (NGFW) which provides Layer 7 security, SSL proxy (for captive portal), and ADC and TLB (for reverse proxy).
• Premier Secure SD-WAN: All Prime Secure SD-WAN tier features plus application performance optimization for best application experience and TCP optimization.
• Premier Elite SD-WAN: All Premier Secure SD-WAN tier features plus unified threat management (UTM).

Bandwidth requirements

In addition to the features needed, the license specifies the amount of bandwidth that can be used. Versa Networks measures bandwidth usage based on the WAN interface; for multiple WAN interfaces, bandwidth is aggregated.

Versa tracks the 95th percentile bandwidth usage, allowing the VOS CPE device to exceed the configured bandwidth 5% of the time.

High Availability (HA)

Versa Networks provides stateful HA synchronization capabilities across active-standby clusters. For any tier you will need NGFW and UTM capabilities, including secure SD-WAN tiers. Bandwidth capacity must match the bandwidth capacity of the underlying SKU on a device. You can learn more in the Versa Docs Portal.

How to deploy Versa Networks with MVE

For further details on how to deploy Megaport Virtual Edge using Versa Secure SD-WAN, visit our Docs Portal.

VeloCloud SD-WAN

Velocloud SD-WAN consists of globally distributed Cloud Gateways as well as Velocloud SD-WAN Edges. MVE hosts edge devices only.

The Velocloud Orchestrator management console is used to create an edge profile and edge device. You then apply this profile to your MVE.

VeloCloud SD-WAN Edge licensing consists of 4 components, namely:

• bandwidth
• edge software edition (feature set)
• gateway regional geolocation
• term.

Each component is summarized below:

Edge licensing allows a customer to link a software subscription to a specific Edge device.

VeloCloud SD-WAN Edition Types

VMware VeloCloud provides the option for either Proof of Concept (POC) or Production Deployments.

POC deployments

If a customer wants to run a POC, then a POC license is available for this purpose with the following attributes:

Production deployments

When an Edge is deployed in a production environment, the license type assigned should align with the software subscription purchased. For example, if the subscription SKU NB-VC100M-PRE-HO-HG-L34S312P-C was purchased for use with the Edge being configured, the correct license type attributes as highlighted would be as follows:

• Bandwidth: 100M
• Edition: Premium
• Term: 1 Year
• HO: Hosted Orchestrator.

How to deploy Velocloud with MVE

For further details on how to deploy Megaport Virtual Edge using Velocloud SD-WAN, visit our Docs Portal.

HPE Aruba EdgeConnect SD-WAN

Licensing for HPE Aruba EdgeConnect SD-WAN is purchased on a per-gateway basis with options as follows:

• Term: 1, 3, 5, or 7 years
• License Type: Foundation, Advanced, or On-Premises (detailed below)
• Bandwidth: Bandwidth requirements per gateway
• Optional: “Add Boost” - available in 100 MB and 10 GB of WAN optimization.
• Optional: “Add Dynamic Threat Defense (DTD)” – for IDS/IPS, additional security-related features may be tied to the DTD license.

HPE Aruba provides three licensing tiers for EdgeConnect SD-WAN deployment: Foundation, Advanced, and On-Premises.

• Foundation provides a value-centric option, including essential SD-WAN features and advanced NGFW features. It includes Cloud Orchestrator.
• Advanced provides maximum performance with advanced SD-WAN features and advanced NGFW features. It includes Cloud Orchestrator.
• On-Premises provides maximum performance for on-premises deployment with advanced SD-WAN features and advanced NGFW features.

The bandwidth licensing is based on cumulative bandwidth via the WAN port.

How to deploy HPE Aruba with MVE

For further details on how to deploy Megaport Virtual Edge using HPE Aruba EdgeConnect SD-WAN, visit our Docs Portal.

Palo Alto

Prisma SD-WAN

Megaport offers two flavours of Palo Alto SD-WAN to cater for the branch office as well as the data center software model, both supported via MVE:

1. SD-WAN 310xv: for branch offices

2. SD-WAN 7108V: for data centers.

Branch office subscription

You can choose from one of the three options below for the branch subscription (per-device):

• Small (S): up to 25 Mbps
• Medium (M): up to 250 Mbps
• Large (L): up to 2,500 Mbps.

Bandwidth tiers are based on the maximum ingress and egress bandwidth per device. Beyond the S, M, and L license, you can still order the following bandwidth tiers:

• 25 Mbps
• 50 Mbps
• 150 Mbps
• 250 Mbps
• 500 Mbps
• 1 Gbps
• 2.5 Gbps.

This option also includes the zone based firewall (ZBFW) add-on.

The following optional add-on licenses are available for a device-based branch subscription:

• WAN Clarity Reporting (WCR): AIOps capabilities and system-generated reports.
• Clarity Network DVR: Data retention and visibility beyond the default seven days.

1. Per-branch site subscription

Recommended for users with two or more devices per site or HA sites, and based on the following tiers:

• Small (S): up to 25 Mbps across all ION devices in a branch site
• Medium (M): up to 250 Mbps across all ION devices in a branch site
• Large (L): up to 2,500 Mbps across all ION devices in a branch site.

Per-site licenses include ZBFW, DVR, and WCR in the list price.

2. Aggregate bandwidth subscription

This subscription provides the option to purchase an aggregate bandwidth quantity (in Mbps) that can be shared across all branch sites, including HA scenarios.

This includes the ZBFW, DVR, and WCR license add-ons.

All license options are from one year to five years.

Data center subscription

A data center subscription is needed when deploying the MVE SD-WAN 7108V version on the Megaport platform. This covers the features needed for data center sites and supports throughput up to 3 Gbps using 8vCPUs.

How to deploy Palo Alto Prisma with MVE

For further details on how to deploy Megaport Virtual Edge using Palo Alto SD-WAN, visit our Docs Portal.

VM-Series

For the Palo Alto VM-Series MVEs, Megaport supports the Bring Your Own License (BYOL) model.

For PAN-OS versions >10.0.4, this can be delivered as either software NGFW credits (flexible vCPU) or as VM-Series Model (fixed vCPU) licenses.

Full details software NGFW credit options can be found here.

VM-Series Model licenses are available on all PAN-OS versions although greater features and flexible vCPUs are possible on version 10.04 and greater.

The fixed vCPU models and associated vCPU are covered as follows:

• VM-50 / VM-100 – 2 vCPU
• VM-300 - 2 / 4 vCPU
• VM-500 - 2 / 4 / 8 vCPU
• VM-700 - 2 / 4 / 8 / 16 vCPU.

Security services and/or a Panorama deployment to manage the firewalls come at an additional cost.

How to deploy Palo Alto VM-Series with MVE

For further details on how to deploy Megaport Virtual Edge using Palo Alto VM-Series, visit our Docs Portal.

6WIND VSR

6WIND VSR with Megaport’s MVE provides four licensed network functions:

1. Virtual Border Router (vBR): Facilitates efficient interconnection between network segments, reducing latency and improving performance. Ideal for connecting with hyperscalers, Internet Exchanges, or upstream service providers.
2. Virtual Carrier Grade Network Address Translation (vCGNAT): Extends IPv4 address lifespan by enabling multiple users to share one public IP, improving security by hiding internal IPs. Supports NAT44 and NAT64 with DNS64.
3. Virtual Security Gateway (vSecGW): Provides scalable Layer 3 IPSec VPN connectivity for fixed, wireless, and converged networks, supporting site-to-site or remote user connections.
4. Virtual L3/L4 Firewall (vFW): Protects against cyber threats while ensuring performance, helping meet regulatory requirements and safeguard data.

To create an MVE, you need a Megaport Portal account with ordering permissions and a valid 6WIND license.

To obtain a trial 6WIND license, submit a request through the 6WIND VSR evaluation page, or contact 6WIND Sales, a reseller, or your Megaport Sales Representative.

How to deploy 6Wind VSR with MVE

For further details on how to deploy Megaport Virtual Edge using 6Wind VSR, visit our Docs Portal.

Aviatrix

Aviatrix provides licensing to users on cloud providers for the customer IDs (licenses) that are needed to access the Aviatrix Cloud Network Controller and Aviatrix Cloud Network CoPilot.

This service also calculates Aviatrix bills based on usage. Full details on the required subscriptions per CSP are detailed here.

How to deploy Aviatrix with MVE

For further details on how to deploy Megaport Virtual Edge using Aviatrix, visit our Docs Portal.

Conclusion

Rarely does a one-size-fits-all approach work for a customer when it comes to deploying an SD-WAN solution. Many have different bandwidth, performance, features, and support requirements driven by various use cases for different business needs.

We hope this primer on the differences in licensing between major SD-WAN vendors helps you better understand the packages you’ll need to select to deploy MVE within your SD-WAN solutions and begin optimizing and modernizing your WAN to reduce operating costs, as well as improve network performance and security.