Managed Meraki SD-WAN: What the Service Covers

Jan 14, 2026

Connecting a few branches over internet links is the easy part. Keeping every tunnel up, every application on the right path and every failover genuinely tested is where the ongoing work sits. In this blog, we'll look at the SD-WAN side of our Meraki Security and SD-WAN managed service: AutoVPN, intelligent path control, hybrid WAN, the technology we cover and what each tier adds.

Managed Meraki SD-WAN: AutoVPN, path control and hybrid WAN on Meraki MX

Meraki SD-WAN: Where Does It Sit in Our Managed Service?

Meraki SD-WAN is managed under our Meraki Security and SD-WAN service, one of nine domains in our managed services. It covers Cisco Meraki MX appliances running multi-WAN or full SD-WAN, plus the virtual MX (vMX) in public cloud. This post covers the WAN side of that service; the firewall side has its own companion post.

The included technology is the Meraki MX with SD-WAN, the Meraki vMX, and the Meraki Advanced Security and SD-WAN Plus licences that unlock the features below. If an MX only runs one WAN link to give a site access, it belongs in our Meraki Access service instead.

Security and SD-WAN live on the same appliance, so they're managed as one Meraki Security and SD-WAN service. For next-generation firewall, threat protection and security triage, read Managed Meraki Security: Firewall and Threat Protection.

AutoVPN: How Do We Build and Run the Overlay?

AutoVPN is Meraki's automated site-to-site VPN. Each MX builds encrypted IPsec tunnels to its peers from settings in the dashboard, with no per-tunnel crypto configuration to maintain. We design the topology, usually hub-and-spoke, set primary and secondary paths, configure failover and decide which subnets each site advertises.

Hub-and-spoke suits most organisations. Branches connect to one or two hubs, often an MX in the data centre or a vMX in the cloud, and traffic between branches flows through the hub. A second hub gives every spoke somewhere to go if the first one is unavailable.

Subnet advertisement sounds minor until two sites turn out to use the same address range. Getting it right up front avoids routing surprises later, especially after an acquisition or a new site build.

Pro-Tip: Test failover on purpose. In a maintenance window, disconnect the primary uplink at one site, confirm the tunnels re-form and traffic moves to the secondary path, then reconnect and watch it fail back. A failover that has never been tested is only a theory.

Path Control: Putting Each Application on the Right Link

Intelligent path control decides which link each application uses. It combines policy-based routing, where you choose the path for a given application or subnet, with dynamic path selection, where the MX moves traffic based on measured jitter, delay, loss and bandwidth. Voice and video stay on a clean link when another degrades.

Policy-Based Routing

Policy-based routing handles the predictable cases. Bulk backup traffic might always take the cheaper link, while a line-of-business application always prefers the primary.

Dynamic Path Selection

Dynamic path selection handles the unpredictable ones. If loss or latency on the preferred path falls outside the performance class set for an application, the MX shifts that traffic to a link that meets it.

Hybrid WAN

Hybrid WAN applies the same per-application control across MPLS, direct internet and 4G LTE links. It's a practical way to run private circuits and internet side by side while you decide how far to move off MPLS, the journey our Meraki SD-WAN case study describes.

In our service, intelligent path control and hybrid WAN come in at the Advanced tier, together with SD-WAN analytics.

SD-WAN Tiers: What Does Each Level Add?

You choose one tier for the whole engagement, and each includes everything in the one before it. Essential gets the overlay built and running in business hours, Advanced adds path intelligence and security triage over extended hours, and Critical adds the full security stack with 24x7 incident response for mission-critical networks.

Essential

Next-generation firewall management, base SD-WAN and AutoVPN, site-to-site VPNs, event log retention and a service dashboard, with monitoring and incident response in business hours.

Advanced

Security incident triage and response, orchestration at scale, intelligent path control, hybrid WAN and SD-WAN analytics. Monthly reporting, a monthly allowance of simple changes and a shared Customer Success Manager come with it.

Critical

Layer 7 firewall as a service, content filtering, VPN as a service, advanced threat protection and application visibility, with 24x7x365 cover, a named Level 3 engineer and a named Customer Success Manager.

Operations: How Do We Run Your SD-WAN Day to Day?

We run your SD-WAN from the same operational picture you see. Highlight shows device health, performance and open incidents across every site, and the customer portal holds your requests, planned changes, maintenance windows, reports and root-cause analyses. The service is co-managed, so your team keeps full access to the Meraki dashboard.

Plenty of WAN complaints start beyond your own kit, at a carrier, a cloud region or a SaaS platform. ThousandEyes can be added for visibility of the internet, cloud and SaaS paths your sites rely on, which helps separate a carrier fault from a configuration one.

Taking on your SD-WAN begins with a structured transition. We run discovery, set up tooling, build a risk register and remediation plan, then complete knowledge transfer and formal operational acceptance, usually within four to twelve weeks. Running Catalyst SD-WAN rather than Meraki? Our Cisco SD-WAN service covers that platform.

Managed Meraki SD-WAN: FAQs

What Is Managed Meraki SD-WAN?

It's the WAN side of IPTel's Meraki Security and SD-WAN managed service. We design, monitor and manage AutoVPN, failover, intelligent path control and hybrid WAN on Meraki MX and vMX appliances, as one of the nine domains in our managed services.

How Is Meraki SD-WAN Different From Meraki Access?

Meraki Access covers MS switches, MR access points and MX appliances in single-WAN mode. Once an MX runs multiple WAN links, full SD-WAN or a vMX, it's managed under Meraki Security and SD-WAN.

Can Meraki SD-WAN Combine MPLS, Internet and 4G?

Yes. Hybrid WAN applies per-application path control across MPLS, direct internet and 4G LTE links. In our service it's part of the Advanced tier, along with intelligent path control and SD-WAN analytics.

Is Managed Meraki SD-WAN Covered 24x7?

Only on the Critical tier, which provides 24x7x365 incident response. Essential covers business hours and Advanced covers extended business hours, so pick the tier that matches how critical your WAN is.

Managed Meraki SD-WAN: Summary

Meraki SD-WAN is quick to switch on and easy to neglect. Our managed service keeps the AutoVPN overlay, failover paths and per-application policies designed, tested and monitored, with the security side managed on the same appliance and your team keeping full access throughout.

Need Help With Meraki SD-WAN?

If you're weighing up managed SD-WAN, our free 10-minute Build Your Business Case assessment gives you a recommended service tier and the value at stake for your network. You can also read more about managed Meraki Security and SD-WAN and our wider managed services.

If that's useful, make an enquiry or drop the IPTel team a line at sales@iptel.com.au.