SASE and SD-WAN in Australian MSPs: The Network Architecture Shift
The traditional MSP network architecture β MPLS circuits, site-to-site VPNs, and a central data centre β is being replaced by SASE (Secure Access Service Edge) and SD-WAN. This is one of the most significant infrastructure shifts in the Australian MSP industry in a decade.
What SASE Actually Is
SASE (pronounced "sassy") combines networking and security into a single cloud-delivered service. The core components:
- SD-WAN β software-defined routing that optimises traffic across multiple connections
- SWG (Secure Web Gateway) β filters web traffic for security threats
- CASB (Cloud Access Security Broker) β governs access to SaaS applications
- ZTNA (Zero Trust Network Access) β replaces VPNs with identity-based access
- FWaaS (Firewall as a Service) β cloud-delivered firewall capabilities
The key difference from the old model: instead of backhauling traffic through a central data centre, traffic goes directly to the cloud edge, where security policies are enforced.
The Australian Adoption Timeline
Australian MSPs have been slower to adopt SASE than their US and European counterparts, but the pace is accelerating:
| Year | Adoption | Driver |
|---|---|---|
| 2022-2023 | Early adopters | Telstra, Optus launching SD-WAN services |
| 2024-2025 | Growing adoption | SASE providers entering AU market |
| 2025-2026 | Mainstream | Legacy MPLS contracts expiring, renewal to SASE |
| 2027-2028 | Near-universal | MPLS becomes premium/legacy product |
What This Means for MSP Engineers
The Network Engineer's Role Is Changing
Traditional network engineering in MSPs has been about managing routers, switches, firewalls, and MPLS circuits. The SASE shift changes this to:
- Policy management β defining rules in a cloud console rather than configuring CLI
- Provider management β managing relationships with SASE providers (Zscaler, Netskope, Cloudflare, Palo Alto Prisma)
- Troubleshooting β diagnosing issues in a distributed, cloud-delivered architecture
- Automation β scripting policy deployment across hundreds of client orgs
The Skills That Matter
| Old Skill | New Skill |
|---|---|
| CLI configuration | Policy-as-code (Terraform, APIs) |
| Spanning tree / VLANs | SD-WAN orchestration |
| On-prem firewall rules | Cloud-delivered FWaaS policies |
| MPLS circuit management | Internet link management + optimisation |
| Site-to-site VPN config | ZTNA configuration |
| Network monitoring (SNMP) | SASE dashboard analytics |
The MSP Provider Landscape
The major SASE providers in the Australian market:
| Provider | Strength | Typical MSP Use Case |
|---|---|---|
| Zscaler | Internet security, ZTNA | Large enterprise-focused MSPs |
| Netskope | CASB, data protection | Compliance-heavy clients |
| Cloudflare | Performance, global network | SMB-focused MSPs, cost-sensitive |
| Palo Alto Prisma | Full SASE suite | Security-first MSPs |
| Fortinet | Integrated SD-WAN + security | Mid-market MSPs with existing Fortinet |
| Cisco Viptela | SD-WAN leader | Telco-owned MSPs (Telstra, Optus) |
The Business Case for MSPs
SASE adoption is accelerating because it's cheaper for both MSPs and their clients:
Old model: MPLS circuit ($500-2000/mo per site) + VPN concentrator + firewall + central internet breakout
SASE model: Broadband internet ($100-300/mo per site) + SASE subscription ($5-15/user/mo)
The savings are significant enough that many MSPs are using the SASE transition as a competitive differentiator.
The Dark Side of SASE
Not everything about the SASE shift is positive for engineers:
- Less hands-on networking β the craft of network engineering is being replaced by policy management
- Vendor lock-in β once you choose a SASE provider, switching is painful
- Complexity at scale β troubleshooting across cloud-delivered stacks is harder than chasing a single CLI issue
- Job consolidation β one SASE engineer can manage what used to take three network engineers
Related Reading
- Zero Trust in Australian MSPs: Adoption Trends
- MSP Cloud Migration Guide
- MSP Remote Work Security Guide
- MSP Cybersecurity Incident Response
Up Next read this next
β οΈ The Cost of Waiting
Australian MSP workers who negotiated using our salary data earned an average of $8,200 more per year. Every month you wait is ~$683 left on the table.
π° Check if you're underpaid βπ Free Resource: Red Flag Checklist
12 contract clauses every Australian MSP worker should flag before signing. Includes non-compete traps, sham contracting indicators, and on-call gotchas.
Was this helpful?