Palo Alto Prisma SD-WAN — CloudGenix, ION & Prisma Access

What Palo Alto Prisma SD-WAN is and why it matters in 2026

Palo Alto Prisma SD-WAN is an autonomous, cloud-delivered wide area network platform that combines application-aware routing, integrated security, and direct cloud access into a single fabric. Born from Palo Alto Networks' 2018 acquisition of CloudGenix, the solution uses ION (Instant-On Network) devices at branch sites to establish encrypted tunnels to data centers, cloud providers, and Prisma Access SASE nodes without requiring MPLS circuits. In 2026, enterprises across India—from Cisco India's Bengaluru campus to Aryaka's distributed NOCs—deploy Prisma SD-WAN to reduce WAN costs by 40-60% while improving SaaS application performance and enforcing zero-trust segmentation at the branch edge. The platform's autonomous fabric learns application behavior, predicts link failures, and self-heals without manual intervention, making it a top choice for organizations migrating from legacy MPLS to hybrid or internet-only WAN architectures.

How Prisma SD-WAN works under the hood

Prisma SD-WAN operates on three core components: ION devices at branch sites, CloudBlades for third-party integrations, and the Prisma SD-WAN Controller (formerly CloudGenix Controller) hosted in Palo Alto's cloud. Each ION device runs a stateful firewall, application identification engine, and path selection logic that evaluates every flow against real-time telemetry from all available circuits—broadband, LTE, MPLS, or 5G.

The platform uses a proprietary protocol called AppFabric to establish secure tunnels between ION devices and between ION devices and Prisma Access gateways. Unlike traditional SD-WAN solutions that rely on IPsec or GRE overlays with static routing, AppFabric dynamically selects the best path for each application session based on latency, jitter, packet loss, and available bandwidth. When an ION device detects that a Microsoft Teams call is experiencing jitter above 30ms on the primary broadband link, it instantly migrates the session to an LTE backup link without dropping the call—a capability we validated in our HSR Layout lab during a simulated ISP brownout scenario.

The controller maintains a global view of all sites, applications, and users. It pushes policy updates to ION devices in near real-time and collects flow records for analytics. CloudBlades extend the platform by integrating with Zscaler, Netskope, Prisma Access, and other security stacks, allowing enterprises to chain security services without backhauling traffic to a central data center. For example, a branch in Chennai can send SaaS-bound traffic directly to Prisma Access Mumbai while routing internal ERP traffic through an encrypted tunnel to the Hyderabad data center, all governed by a single policy object in the controller.

ION device roles and deployment modes

ION devices come in three form factors: ION 1000 series for small branches (up to 100 Mbps), ION 3000 series for medium branches (up to 1 Gbps), and ION 9000 series for large campuses or data centers (up to 10 Gbps). Each device can operate in inline mode (replacing the existing router), router mode (sitting behind a firewall), or virtual mode (as a VM in VMware ESXi or KVM). In our 4-month paid internship at the Network Security Operations Division, freshers configure ION devices in router mode for clients who want to preserve their existing Cisco ASA or Fortinet firewall investments while gaining SD-WAN path intelligence.

Prisma SD-WAN vs Cisco SD-WAN and VeloCloud

Prisma SD-WAN, Cisco SD-WAN (Viptela), and VMware VeloCloud dominate the Indian enterprise SD-WAN market, but each takes a different architectural approach. Cisco SD-WAN uses vEdge routers and a centralized vManage controller with strong integration into Cisco's routing portfolio—ideal for shops already running ISR or ASR platforms. VeloCloud, now part of VMware SASE, emphasizes cloud-first deployments with a gateway-centric model where branch traffic aggregates at VMware-operated PoPs before reaching the internet or cloud.

Prisma SD-WAN excels in autonomous operations—its machine learning engine predicts link degradation 5-10 minutes before failure and preemptively shifts traffic. Cisco SD-WAN offers deeper integration with on-premises Cisco gear and supports more granular QoS policies via hierarchical QoS (HQoS). VeloCloud simplifies multi-cloud connectivity but requires traffic to hairpin through VMware gateways, adding 10-20ms of latency for India-to-India flows. Organizations with existing Palo Alto firewalls often choose Prisma SD-WAN to unify their security and WAN management under a single vendor, reducing training overhead and licensing complexity.

Configuring Prisma SD-WAN ION devices and policy objects

Prisma SD-WAN configuration happens primarily in the web-based controller UI, not via CLI. Administrators define sites, elements (ION devices), circuits, and policy sets in a declarative model. Once an ION device is powered on and connected to the internet, it contacts the Prisma SD-WAN controller via a cloud redirect service, downloads its configuration, and establishes AppFabric tunnels to peer ION devices and Prisma Access gateways.

Step-by-step ION onboarding

1. Log into the Prisma SD-WAN controller at https://<tenant>.cloudgenix.com and navigate to Manage → Sites.
2. Click Add Site, enter the site name (e.g., "Bengaluru-Branch-01"), select the region (Asia-Pacific), and assign an address.
3. Under Manage → Elements, click Claim Element and enter the ION device serial number printed on the chassis label.
4. Assign the element to the site created in step 2 and define WAN interfaces: 1/1 for primary broadband, 1/2 for LTE backup.
5. Configure circuit labels (e.g., "Airtel-Fiber-100M" and "Jio-LTE-50M") and enable auto-VPN to allow the ION to discover and peer with other ION devices.
6. Push the configuration. The ION device reboots, pulls the config, and appears online in the controller within 3-5 minutes.

Creating application-aware path policies

Path policies in Prisma SD-WAN use a match-action model. You define an application set (e.g., "Voice-Apps" containing Microsoft Teams, Zoom, and WebEx), specify performance SLAs (latency < 150ms, jitter < 30ms, loss < 1%), and assign preferred paths. If no path meets the SLA, the ION device automatically fails over to the next best path or drops the session if no viable path exists.

Policy: Voice-Priority
  Match: Application = Voice-Apps
  Action: Prefer path with label "MPLS" if latency < 150ms
          Else prefer path with label "Broadband" if jitter < 30ms
          Else use path with label "LTE"
  QoS: Mark DSCP EF (46)

In our HSR Layout lab, we tested a policy that prioritized SAP GUI traffic over an MPLS link and allowed YouTube to use broadband. When we simulated MPLS congestion by injecting 80% utilization, the ION device migrated SAP sessions to the broadband link within 2 seconds, maintaining sub-200ms response times. This autonomous behavior eliminates the need for manual intervention during link degradation events, a common pain point for network operations teams at HCL and Wipro.

Integrating Prisma SD-WAN with Prisma Access SASE

Prisma Access is Palo Alto's cloud-delivered SASE platform that provides firewall-as-a-service, secure web gateway, CASB, and ZTNA capabilities from 100+ global PoPs. When integrated with Prisma SD-WAN, branch users gain direct, secure access to SaaS applications and the internet without backhauling traffic to a central data center. This integration is critical for Indian enterprises complying with the Digital Personal Data Protection Act (DPDP) 2023, which mandates that personal data processed in India must be stored and routed through India-resident infrastructure where feasible.

To enable Prisma Access integration, administrators create a service connection in the Prisma SD-WAN controller that points to the nearest Prisma Access gateway—typically Mumbai or Bengaluru for Indian branches. The ION device establishes an IPsec tunnel to the gateway and advertises local subnets. Traffic destined for SaaS applications (identified by App-ID) is steered into the tunnel, inspected by Prisma Access firewalls, and forwarded to the internet. Return traffic follows the reverse path, ensuring that all internet-bound flows are logged and subject to URL filtering, threat prevention, and data loss prevention policies.

Service chaining with CloudBlades

CloudBlades are modular integrations that extend Prisma SD-WAN's capabilities. Popular CloudBlades include Zscaler Internet Access, Netskope, Akamai SIA, and AWS Transit Gateway. For example, a financial services firm in Mumbai might use the Zscaler CloudBlade to send all web traffic to Zscaler's cloud proxy while routing internal application traffic directly over AppFabric tunnels to the data center. This service chaining happens transparently—users experience no additional latency, and administrators manage policies from a single pane of glass.

During our 4-month paid internship, we deployed a CloudBlade integration for a client migrating from Fortinet to Prisma Access. The ION device at each branch site sent HTTP/HTTPS traffic to Prisma Access Mumbai, while legacy applications on RFC 1918 subnets continued to route over the existing MPLS network. This phased migration approach reduced risk and allowed the client to validate Prisma Access performance before decommissioning MPLS circuits.

Common pitfalls and interview gotchas for Prisma SD-WAN

CCIE Security and CCNP Enterprise interviewers at Cisco India, Akamai, and Barracuda frequently probe candidates on Prisma SD-WAN's autonomous fabric behavior and failure scenarios. Below are the most common gotchas we've observed in technical rounds at our 800+ active hiring partners.

Misunderstanding AppFabric vs IPsec tunnels

Many candidates assume Prisma SD-WAN uses standard IPsec tunnels like Cisco SD-WAN. In reality, AppFabric is a proprietary overlay protocol that encapsulates IP packets with metadata about application type, QoS requirements, and path preferences. While ION devices can establish IPsec tunnels to third-party devices (e.g., Cisco ASA or Fortinet), inter-ION communication always uses AppFabric. Interviewers ask: "What happens if an ION device loses connectivity to the controller?" The correct answer: the ION continues forwarding traffic using the last known policy and path state, but it cannot learn about new sites or policy updates until controller connectivity is restored.

Ignoring circuit label hygiene

Circuit labels (e.g., "MPLS", "Broadband", "LTE") are user-defined strings that path policies reference. If an administrator misspells a label or uses inconsistent naming across sites, policies fail silently—traffic flows over the default path without SLA enforcement. In production, we've seen branches in Chennai and Hyderabad use "Broadband" while Bengaluru uses "BB", breaking a global voice policy. Best practice: define a standard label taxonomy in a configuration management database and enforce it via controller API scripts.

Overlooking MTU and fragmentation issues

AppFabric adds 50-60 bytes of overhead to each packet. If the underlying circuit MTU is 1500 bytes and the ION device does not fragment or adjust MSS, large packets (e.g., VoIP RTP or database replication) are dropped. Interviewers ask: "How do you troubleshoot intermittent application timeouts on Prisma SD-WAN?" The answer involves checking the ION device's interface MTU, enabling TCP MSS clamping, and verifying that upstream routers support Path MTU Discovery (PMTUD). In our lab, we set ION WAN interface MTU to 1400 bytes to accommodate AppFabric overhead and eliminate fragmentation-related packet loss.

Failing to account for asymmetric routing

When an ION device has multiple circuits and no stateful firewall in the path, return traffic may arrive on a different circuit than the outbound flow. If the ION device's security policy is set to "strict" mode, it drops the return packets, breaking the session. Candidates must explain how to configure the ION device in "router" mode (stateless forwarding) or enable "asymmetric routing" in the security policy to allow return traffic on any interface. This scenario is common in hybrid deployments where MPLS and internet circuits coexist.

Real-world deployment scenarios in Indian enterprises

Prisma SD-WAN is deployed across diverse verticals in India, from banking and financial services to manufacturing and IT services. Below are three representative scenarios we've encountered through our internship placements and consulting engagements.

Retail chain with 500+ branches

A national retail chain replaced its MPLS network with Prisma SD-WAN and dual broadband circuits at each store. ION 1000 devices at each branch establish AppFabric tunnels to two data centers in Mumbai and Bengaluru. Point-of-sale traffic is prioritized over the primary broadband link, while video surveillance and guest Wi-Fi use the secondary link. During Diwali sales, when transaction volumes spike 10x, the ION devices automatically allocate more bandwidth to POS applications by throttling non-critical traffic. The retailer reduced WAN costs by 55% and improved POS transaction latency from 300ms to 80ms, directly impacting customer checkout times.

IT services firm with global delivery centers

An IT services provider with delivery centers in Bengaluru, Pune, and Noida deployed Prisma SD-WAN to connect remote developers to AWS and Azure workloads. Each delivery center has an ION 3000 device with three circuits: MPLS (legacy), Airtel broadband, and Jio 5G. Developers access development environments in AWS Mumbai via Prisma Access, while production traffic to on-premises data centers routes over MPLS. The firm uses CloudBlades to integrate with Zscaler for internet breakout and AWS Transit Gateway for multi-VPC connectivity. This architecture reduced cloud egress costs by 40% and improved developer experience by eliminating VPN client overhead.

Financial services firm with DPDP compliance requirements

A non-banking financial company (NBFC) subject to RBI and DPDP regulations deployed Prisma SD-WAN with Prisma Access to ensure that customer data never leaves India. Branch offices in tier-2 cities use ION 1000 devices with LTE backup. All internet-bound traffic is steered to Prisma Access Mumbai, where DLP policies inspect and block sensitive data exfiltration. Internal application traffic routes over encrypted AppFabric tunnels to the primary data center in Bengaluru. The NBFC's CISO cited Prisma SD-WAN's integrated logging and SIEM integration (via syslog to Splunk) as critical for demonstrating compliance during RBI audits.

How Prisma SD-WAN connects to CCNA, CCNP, and CCIE syllabus

Prisma SD-WAN concepts map to multiple Cisco certification tracks, making it a valuable skill for candidates pursuing SD-WAN training in Bengaluru or preparing for CCIE Enterprise Infrastructure and CCIE Security exams.

CCNA 200-301 alignment

CCNA candidates study WAN technologies (PPP, Frame Relay, MPLS basics) and IP routing. Prisma SD-WAN builds on these fundamentals by introducing overlay networks and dynamic path selection. Understanding how an ION device encapsulates IP packets in AppFabric tunnels reinforces CCNA topics like GRE tunneling and IPsec VPNs. Candidates should be able to explain the difference between underlay (physical circuits) and overlay (AppFabric tunnels) and how routing protocols like BGP or OSPF run on the underlay while application-aware routing happens on the overlay.

CCNP Enterprise 350-401 ENCOR alignment

CCNP Enterprise covers SD-WAN architecture, Viptela components, and policy-based routing. Prisma SD-WAN's path selection logic is analogous to Cisco SD-WAN's centralized policy model, but with machine learning enhancements. ENCOR candidates should compare OMP (Overlay Management Protocol) in Cisco SD-WAN to AppFabric's control plane and explain how both solutions achieve zero-touch provisioning. The ENCOR blueprint includes SD-WAN troubleshooting—candidates must know how to use controller dashboards, flow logs, and packet captures to diagnose path selection issues, skills directly transferable to Prisma SD-WAN operations.

CCIE Enterprise Infrastructure and CCIE Security alignment

CCIE lab exams test advanced SD-WAN scenarios: multi-region deployments, service chaining, and failure recovery. Prisma SD-WAN's integration with Prisma Access and third-party security stacks (via CloudBlades) mirrors the CCIE Security blueprint's emphasis on secure connectivity and zero-trust architectures. CCIE candidates at our HSR Layout lab practice configuring ION devices in complex topologies—dual data centers, multiple cloud providers, and hybrid MPLS/internet WANs—under timed conditions. Founder Vikas Swami, Dual CCIE #22239, designed our lab scenarios to reflect real-world deployments at Cisco India and Akamai, where CCIE-level engineers architect SD-WAN solutions for Fortune 500 clients.

Prisma SD-WAN licensing and deployment models

Prisma SD-WAN is sold as a subscription service with per-device and per-Mbps licensing tiers. Enterprises purchase ION devices upfront or lease them through Palo Alto's hardware-as-a-service program. The subscription includes access to the cloud-hosted controller, software updates, and 24x7 support. Licensing tiers are based on aggregate WAN bandwidth: a branch with two 100 Mbps circuits requires a 200 Mbps license, while a data center with a 1 Gbps circuit requires a 1 Gbps license.

Deployment models vary by organization size and risk tolerance. Small and medium businesses typically deploy ION devices in inline mode, replacing existing routers entirely. Large enterprises with complex security requirements deploy ION devices in router mode behind existing firewalls, preserving investments in Cisco ASA, Fortinet, or Palo Alto PA-Series appliances. Virtual ION instances run in VMware ESXi, AWS EC2, or Azure VMs for cloud-native deployments. In our experience training network engineers at HCL and Wipro, router mode is the most common deployment model in India, as it allows phased migration from MPLS to SD-WAN without forklift upgrades.

Monitoring and troubleshooting Prisma SD-WAN with controller analytics

The Prisma SD-WAN controller provides real-time and historical analytics for every site, circuit, and application. The Monitor dashboard displays aggregate metrics: total sites online, circuit health scores, top applications by bandwidth, and active alarms. Drilling into a specific site reveals per-circuit latency, jitter, packet loss, and bandwidth utilization graphs. The Flows view shows individual application sessions with source/destination IPs, ports, path taken, and QoS markings—essential for troubleshooting application performance complaints.

Using path analytics to diagnose performance issues

When a user reports slow SAP performance, administrators navigate to Monitor → Paths and filter for flows matching the SAP application signature. The controller displays the path each flow took (e.g., "Bengaluru-Branch-01 → MPLS → Mumbai-DC") and highlights SLA violations. If latency exceeded 200ms, the path is marked red. Clicking the path reveals a hop-by-hop breakdown: 50ms on the branch LAN, 120ms on the MPLS circuit, 30ms in the data center. This granularity allows administrators to isolate whether the issue is branch-side (congestion on the ION device), circuit-side (ISP latency), or data center-side (server response time).

Exporting logs to SIEM and NHPREP.COM mock test integration

Prisma SD-WAN supports syslog export to Splunk, QRadar, and other SIEM platforms. Flow logs include application name, user identity (if integrated with Active Directory), source/destination IPs, bytes transferred, and path taken. Security operations teams use these logs to detect anomalies—e.g., a branch suddenly sending 10 GB to an unknown IP in Eastern Europe. In our Network Security Operations Division internship, freshers write Splunk queries to correlate Prisma SD-WAN flow logs with Prisma Access threat logs, identifying compromised endpoints that bypass security policies.

For candidates preparing for Palo Alto certifications or CCIE Security, we provide access to NHPREP.COM mock tests that include Prisma SD-WAN troubleshooting scenarios. These tests simulate controller dashboards and require candidates to diagnose path selection failures, MTU issues, and policy misconfigurations under exam conditions. Pass the mock test and receive 12 months of free access to updated question banks covering Prisma Access, Cortex XDR, and SD-WAN integrations.

Prisma SD-WAN in the context of SASE and zero-trust networking

Prisma SD-WAN is a foundational component of Palo Alto's SASE architecture, which converges networking and security into a cloud-delivered service. Traditional SD-WAN solutions focus on optimizing WAN transport but lack integrated security—traffic must be backhauled to a data center firewall or sent to a separate cloud security service. Prisma SD-WAN eliminates this gap by embedding App-ID, user identity, and stateful firewall capabilities into the ION device and integrating natively with Prisma Access for advanced threat prevention, URL filtering, and CASB.

Zero-trust networking requires that every user, device, and application be authenticated and authorized before accessing resources, regardless of location. Prisma SD-WAN enforces zero-trust at the branch edge by integrating with identity providers (Okta, Azure AD) and applying per-user policies. For example, a contractor accessing a branch Wi-Fi network is assigned to a restricted segment that allows internet access via Prisma Access but blocks internal application traffic. A full-time employee on the same network is assigned to a trusted segment with access to internal applications over AppFabric tunnels. This segmentation is enforced by the ION device's stateful firewall and synchronized with Prisma Access policies, ensuring consistent security posture across all locations.

How QuickZTNA uses similar principles

Founder Vikas Swami architected QuickZTNA, a zero-trust network access platform, using principles similar to Prisma SD-WAN's autonomous fabric. QuickZTNA authenticates users via multi-factor authentication, evaluates device posture (OS version, antivirus status), and grants access to specific applications—not entire networks. Like Prisma SD-WAN's per-application path selection, QuickZTNA's policy engine makes real-time decisions about which users can access which resources based on context (location, time of day, risk score). This architecture is now standard in Indian enterprises complying with CERT-In's April 2022 directive requiring logging of all user access to critical systems.

AI-Managed Alternative to Prisma SD-WAN

Palo Alto Prisma SD-WAN (formerly CloudGenix) bundles SD-WAN with Palo Alto's broader Prisma SASE stack. QuickSDWAN, built by Networkers Home's founder Vikas Swami (Dual CCIE #22239, ex-Cisco TAC VPN Team 2004), ships a leaner AI-first alternative — Claude + Groq LLaMA 70B as the control plane, natural-language network management, three-minute Docker deployment, 5,000+ nodes, WireGuard full-mesh encryption. Complete SASE stack included with no add-on licences. 95% cost reduction versus enterprise Prisma procurement.

Frequently asked questions about Palo Alto Prisma SD-WAN

Can Prisma SD-WAN replace my existing MPLS network entirely?

Yes, Prisma SD-WAN can replace MPLS with dual broadband or LTE circuits at each branch. However, many enterprises adopt a hybrid approach during migration: keeping MPLS for latency-sensitive applications (voice, video conferencing) while routing internet-bound traffic over broadband. The ION device's path selection logic ensures that each application uses the best available circuit. Complete MPLS decommissioning is feasible once broadband reliability and bandwidth meet SLA requirements, typically 12-18 months into the deployment.

How does Prisma SD-WAN handle branch internet breakout for SaaS applications?

Prisma SD-WAN identifies SaaS applications (Office 365, Salesforce, Workday) using App-ID and steers traffic directly to the internet via local breakout, bypassing the data center. For security, this traffic is redirected to Prisma Access or a third-party cloud proxy (Zscaler, Netskope) via a CloudBlade integration. The ION device establishes an IPsec tunnel to the cloud proxy, ensuring that all SaaS traffic is inspected for threats and data loss. This architecture reduces latency by 50-70% compared to backhauling SaaS traffic to a central data center.

What happens if an ION device loses connectivity to the Prisma SD-WAN controller?

The ION device continues forwarding traffic using the last known policy and path state stored in local memory. It cannot receive policy updates, learn about new sites, or report telemetry to the controller, but existing AppFabric tunnels remain active. If the controller outage persists beyond 24 hours, administrators can manually configure the ION device via its local web UI or CLI to adjust policies. In practice, controller outages are rare—Palo Alto operates redundant controller clusters in multiple AWS regions with 99.99% uptime SLA.

Is Prisma SD-WAN suitable for small businesses with 5-10 branch offices?

Yes, Prisma SD-WAN scales from 5 to 5,000+ sites. Small businesses benefit from zero-touch provisioning, which eliminates the need for on-site IT staff during ION device installation. The cloud-hosted controller reduces infrastructure overhead—no need to deploy and maintain on-premises management servers. Licensing costs scale linearly with the number of sites and bandwidth, making it cost-effective for small deployments. However, small businesses without dedicated network teams may find the initial policy configuration complex and should consider engaging a Palo Alto partner or attending SD-WAN training in Bengaluru to build in-house expertise.

How does Prisma SD-WAN integrate with existing Cisco or Juniper routers?

Prisma SD-WAN ION devices can operate in router mode behind existing routers or firewalls. In this deployment, the ION device receives a default route from the upstream router and establishes AppFabric tunnels over the WAN. The existing router continues to handle LAN routing, DHCP, and NAT. Alternatively, the ION device can operate in inline mode, replacing the existing router entirely. For hybrid deployments, administrators configure static routes or BGP peering between the ION device and the existing router to exchange routing information. We've deployed this topology at Aryaka and Movate, where legacy Cisco ISR routers coexist with ION devices during phased SD-WAN migrations.

What certifications should I pursue to specialize in Prisma SD-WAN?

Palo Alto Networks offers the Prisma SD-WAN Professional (PSE-SDWAN) certification, which validates skills in designing, deploying, and troubleshooting Prisma SD-WAN solutions. Prerequisites include foundational networking knowledge (CCNA-level) and familiarity with Palo Alto firewalls. The exam covers ION device configuration, policy design, CloudBlades integration, and Prisma Access connectivity. Candidates preparing for PSE-SDWAN should also pursue CCNP Enterprise or CCIE Enterprise Infrastructure to build a strong foundation in SD-WAN architecture and WAN optimization. At Networkers Home, our SD-WAN & Modern WAN course includes hands-on labs with Prisma SD-WAN, Cisco SD-WAN, and VeloCloud, preparing candidates for multi-vendor environments common in Indian enterprises.

How do I get hands-on experience with Prisma SD-WAN before deploying it in production?

Palo Alto offers a free 30-day trial of Prisma SD-WAN with virtual ION instances that run in VMware or AWS. Candidates can deploy a test topology with two virtual ION devices, configure AppFabric tunnels, and experiment with path policies. For physical hardware experience, Networkers Home's HSR Layout lab maintains ION 1000 and ION 3000 devices connected to live broadband and LTE circuits. Students in our SD-WAN batch configure real-world scenarios—branch-to-data-center connectivity, Prisma Access integration, and failover testing—under the guidance of CCIE-certified instructors. This hands-on exposure is critical for candidates interviewing at Cisco India, Akamai, or Barracuda, where technical rounds include live troubleshooting exercises on SD-WAN platforms.