SD-WAN Jamaica: What It Is and When Your Organisation Needs It
SD-WAN is one of those terms that vendors say quickly and buyers nod along to. Stripped of the jargon, SD-WAN in Jamaica solves a simple problem: when your office has more than one way to reach the internet or another site, something intelligent has to decide which path each type of traffic should take, check that those paths are healthy, and move traffic off a path the moment it degrades. That is the whole idea. Everything else is detail.
We delivered a zero-downtime network cutover for a Government of Jamaica agency using exactly this approach. The agency had more than one link available but no intelligent control over how they were used. After the change, general internet traffic ran on one link while a critical central government application was pinned to a separate, more reliable path, with automatic backup between them. No production outage during the cutover.
What SD-WAN actually does
Traditional routing makes a path decision once, based mostly on a static route, and sticks with it until something breaks hard. SD-WAN makes that decision continuously and per application. Three capabilities do the real work:
Steering. You decide which traffic uses which link. Bulk internet browsing and software updates can ride the cheaper commercial ISP link, while a finance application or a connection back to a hosting ministry rides the more reliable circuit. One link being busy no longer slows down the traffic that matters.
Health checks. Instead of trusting that a link is fine because the interface is up, SD-WAN continuously probes something real on the far side and measures latency, jitter, and loss. If a path degrades, even while it stays physically up, traffic moves off it automatically. This is the exact gap that leaves ordinary failover setups quietly broken.
Automatic failover and failback. When a path fails, traffic shifts to the next-best path within seconds, and when the original recovers, traffic returns in a controlled way. Done properly, the users never notice.
When your organisation actually needs it
SD-WAN is not for every office. You need it when some combination of the following is true:
- You have, or should have, more than one link and you want both to earn their keep rather than one sitting idle.
- Some of your traffic genuinely matters more than the rest: a government financial application, VoIP, a connection to a partner agency's VPN.
- An outage on the primary link costs you real money or real public-service disruption, not just an inconvenient hour.
- You operate across more than one site, in Kingston, St. Andrew, Montego Bay, or further, and want them to behave like one network.
If your office has a single link and can tolerate the occasional outage, SD-WAN is overkill and an honest provider will tell you so. The moment a second path and traffic that matters differently enter the picture, the economics change quickly.
How we did it without an outage
The part that makes SD-WAN safe in a live government environment is not the technology, it is the discipline around the change. For that cutover, the work happened inside a planned change window agreed in advance, with a documented backout plan ready before we touched anything, and a change record written up afterwards that the agency could hand to its own oversight.
That record matters as much as the configuration. In a multi-agency environment where multiple ministries may have a stake in the same path, being able to show exactly what changed, when, and how to reverse it is what lets the next person troubleshoot without guessing.
The piece most people skip: monitoring
Here is the catch nobody mentions in the sales pitch. The day you have more than one path is the day you need to be watching all of them. A single-link office knows it is down because everything stops. A multi-path office can lose its primary link, fail over cleanly, and run for weeks on backup without anyone noticing, until the backup fails too and now both are gone.
Without monitoring, SD-WAN can hide a problem instead of surfacing it. That is why we treat ongoing monitoring as part of the service rather than an optional extra. If a link in your design has been down for three days, someone should have known on day one.
Frequently Asked Questions
What is the difference between SD-WAN and a normal dual-ISP setup?
A normal dual-ISP setup usually has one link active and one idle, with a static failover that may or may not work. SD-WAN uses both links at once, steers each type of traffic to the right path, checks path health continuously, and fails over automatically when a path degrades rather than only when it dies.
Does SD-WAN work with FortiGate firewalls?
Yes. SD-WAN is built into FortiOS, so a suitably sized FortiGate can act as the SD-WAN device without separate hardware. Steering rules, SLA health-check probes, and automatic failover are all configured on the firewall itself.
Can SD-WAN connect to GovNet or a partner agency's VPN?
Yes. SD-WAN can steer specific traffic down a government circuit or an IPsec VPN to a partner agency while general internet rides a commercial link, and it can treat that VPN as an automatic backup path if the primary circuit fails.
Do I need SD-WAN if I only have one internet link?
No. SD-WAN earns its place once you have more than one path and traffic that matters differently. With a single link and modest uptime needs, it adds cost without adding much value.
Managed SD-WAN monitoring. SD-WAN is only as good as the monitoring behind it. Talk to Systems Rubix about managed SD-WAN so that a degraded or down path is something we catch, not something you discover when the backup fails too. For the firewall configuration underneath, see five firewall mistakes we see in Jamaican offices.