Network & SASEAnalysis
What a 40-branch company pays per branch per month for MPLS, broadband with SD-WAN, and SASE, from published Indian rate cards, plus TechBag's count of each vendor's Indian PoPs. September 2026.
The question the original version of this piece asked, in December 2025, was why SD-WAN and SASE exist. The better question for an Indian IT head whose carrier MPLS contract is up for renewal is arithmetic: what does each architecture cost per branch per month, what is the money actually buying, and does the provider whose cloud will inspect the traffic have a point of presence anywhere near Nagpur. We have built the example around forty branches of twenty-five people each because that is the shape of the mid-market estate TechBag is asked about most: a regional bank or NBFC, a retail chain, a diagnostics network, a distributor. Every assumption is stated so you can substitute your own invoice.
MPLS first. Carriers do not publish enterprise MPLS prices, which is why most comparisons use guesses. The one published rate card we could find is the National Stock Exchange’s chart of what Tata Communications, Bharti Airtel and Vodafone Idea charge its members for MPLS connectivity: for a 10 Mbps port on a single last mile with the router included, Tata and Airtel list ₹3,25,000 a year and Vodafone Idea ₹2,12,000, plus ₹20,000 to ₹25,000 to install.1 The Tata and Airtel figure is ₹27,083 a month; we have used ₹27,100. A 2026 analysis from a Bengaluru training provider puts metro MPLS at ₹8,000 to ₹15,000 per Mbps per month, which would make the same port ₹80,000 or more.3 We have deliberately used the lower, published carrier figure. If MPLS is overstated anywhere in this piece, it is not here.
Broadband plus SD-WAN next. Two 300 Mbps lines from different ISPs at Airtel’s published ₹1,499 a month each, before GST, come to ₹2,998.4 The SD-WAN edge is a FortiGate 40F: ₹22,000 of hardware spread over 36 months is ₹611 a month, and the Unified Threat Protection subscription at ₹9,000 a year is ₹750; SD-WAN itself is in FortiOS at no extra licence.5 That is ₹4,359 a branch a month, rounded to ₹4,400, for thirty times the bandwidth on two physically separate paths, with web filtering and intrusion prevention running at the branch.
SASE last. Keep the same two lines and the same edge, and add security service edge at US$7 per user per month, which is Cloudflare’s published pay-as-you-go price beyond its fifty free users and the lowest published dollar list price among the six vendors here.6 At an assumed ₹85 to the dollar that is ₹595 a user, ₹14,875 for a 25-person branch, and ₹19,234 in total, rounded to ₹19,200.
Broadband plus SD-WAN is a sixth of the MPLS bill per branch; SASE spends most of that saving on per-user inspection
Rupees per branch per month before GST, 40 branches of 25 users: 10 Mbps MPLS port vs two 300 Mbps broadband lines with a FortiGate 40F vs the same plus SSE at US$7 a user, September 2026
| MPLS port | Two broadband lines | FortiGate edge and UTP | SSE seats, 25 users | |
|---|---|---|---|---|
| MPLS, 10 Mbps | 27,100 | 0 | 0 | 0 |
| Broadband + SD-WAN | 0 | 2,998 | 1,361 | 0 |
| SASE: SD-WAN + SSE | 0 | 2,998 | 1,361 | 14,875 |
Source: NSE rate chart (Tata Communications and Airtel 10 Mbps MPLS); Airtel 300 Mbps published price; Cloudfy Systems FortiGate India pricing; Cloudflare pay-as-you-go price via the TechBag SASE guide; TechBag arithmetic · as of 30 September 2026 · ₹85 to the dollar assumed; totals unrounded (₹4,359 and ₹19,234 in the text's arithmetic); installation, HQ firewall and internet for the MPLS case, 4G failover and staff time excluded
Two sensitivities. At Vodafone Idea’s rate MPLS falls to ₹17,700 a month, four times the SD-WAN figure rather than six.1 And if a branch genuinely needs a line with a service-level agreement, replace one broadband line with a 10 Mbps internet leased line, which Airtel’s own pricing guide puts at ₹8,000 to ₹12,000 a month; the SD-WAN figure becomes ₹10,900 to ₹14,900, still roughly half of MPLS, with the SLA on one leg.2
An MPLS circuit is priced the way leased circuits have always been priced in India: by port speed, by distance and by the SLA. TRAI’s own ceiling tariffs for domestic leased circuits are banded by kilometre, and when it cut them by up to 60% in 2014 the headline figure was the 5 to 500 km band for a 2 Mbps E1, from ₹8,50,000 to ₹3,41,000 a year.14 A broadband line is priced flat: Nagpur pays what Mumbai pays. SD-WAN is the piece of software that lets a company buy the flat-priced thing and still get the behaviour it was paying the distance premium for.
Four hops replace the hairpin: the branch breaks out locally, the overlay makes two cheap lines behave like one, and inspection moves to a PoP near the user
How a branch reaches SaaS and the data centre under SD-WAN and SASE, and where each rupee of the ₹19,200 goes
Branch: two lines, one edge
Two 300 Mbps broadband lines from different ISPs terminate on one SD-WAN appliance. Cost: ₹4,359 a month. The appliance measures loss, jitter and latency on both lines every second.
SD-WAN overlay
Encrypted tunnels across both lines to the data centre and to the SSE provider. Application-aware steering sends voice and ERP down the healthier path and moves them in under a second when a line degrades.
SSE or SASE PoP
Web, SaaS and private-app traffic is inspected in the provider’s nearest point of presence, where the user is, not at head office. Cost: ₹595 a user a month at US$7. PoP distance is the user experience.
SaaS, cloud, data centre
Microsoft 365, the core banking or ERP system, and the public cloud are reached from the PoP, not back through a central firewall. The head-office circuit stops carrying every branch’s internet.
Source: TechBag SASE and SSE guide; vendor architecture documentation for Fortinet, Cato, Cloudflare, Zscaler and Netskope · as of 30 September 2026
The economic consequence is in step three. Under MPLS the security sits at head office and every branch pays, in distance, to reach it. Under SASE the security sits in a provider’s PoP and every user pays, per seat, to be inspected there. The first bill scales with sites and kilometres; the second with people. That is why the worked example flips: forty small branches are cheap to connect and expensive to inspect, and a company with four large branches would find the opposite.
Every SASE vendor publishes a global map. Far fewer publish a list of Indian cities, and the list is the only thing that matters for a branch in Coimbatore, because a user whose traffic is inspected in Mumbai or, worse, Singapore notices it on every click. We counted the distinct Indian cities each of six vendors names in its own documentation or press statements, and nothing else.
Cloudflare names 22 Indian cities; no other SASE vendor names more than five
Distinct Indian cities with a point of presence named in the vendor's own documentation or press statements, TechBag count, September 2026
Source: Cloudflare network page; Zscaler cloud enforcement node list for zscaler.net; Fortinet FortiSASE 7.4 Reference Guide; Netskope via SecurityBrief (May 2025) and IT Brief India (April 2026); Cato and Palo Alto as documented on their TechBag hubs · as of 30 September 2026 · cities, not nodes or regions: Zscaler's 5 cities carry 9 nodes, Netskope's 5 carry 8 data centres, Fortinet's 4 carry 5 PoPs
Cloudflare’s network page lists 22 Indian cities among 348 worldwide, including Nagpur, Patna, Coimbatore, Bhubaneswar, Jalandhar, Kannur and Udaipur, and the company’s architecture runs every service in every city.7 Zscaler’s enforcement-node list for its zscaler.net cloud names nine Indian nodes in five cities, three each in Chennai and Mumbai.8 Netskope reached eight Indian data centres in May 2025, across Mumbai, Delhi, Kolkata, Hyderabad and Chennai, and in April 2026 added a Mumbai management plane so that policy, configuration, metadata and logs can stay in India.1011 Fortinet’s FortiSASE reference guide lists five Indian security PoPs in four cities out of 99 worldwide, with Pune marked limited availability.9 Cato operates two of its 85-plus PoPs in Chennai and Mumbai.12 Palo Alto has documented a Mumbai cloud location for Prisma Access since 2021 and otherwise publishes compute locations by region, so one named city is what the rule allows it.13
For a forty-branch estate the reading is blunt. If your branches are in the five metros, every vendor on the chart can serve them from in-country. If they are in Nagpur, Indore, Raipur, Madurai or Guwahati, the honest shortlist for SSE is shorter than the Gartner quadrant, and the first procurement step is a latency test from three of your own branches, not a feature demo. The SASE and SSE guide sets out that test and the contract clauses that go with it.
The SASE bar is ₹14,900 a branch a month above SD-WAN alone, ₹5.95 lakh a month across forty branches. In the worked example the FortiGate at each branch already filters web traffic and runs intrusion prevention, so the honest question is what inspection in a provider’s cloud adds to inspection in a box.
SASE buys inspection that follows the person out of the branch; SD-WAN alone buys cheaper, faster lines for the people who stay
What each architecture includes at the branch in the worked example, and where its bill grows, September 2026
SD-WAN alone: ₹4,400 a branch
SASE: ₹19,200 a branch at 25 users
Source: TechBag SASE and SSE guide; Fortinet FortiGate UTP bundle contents via Cloudfy Systems; Cloudflare One, Netskope and Zscaler product documentation as summarised on their TechBag pages · as of 30 September 2026
A worked example is only as good as its assumptions, so here are the three points at which this one breaks, each of which you can test against your own invoices in an afternoon.
₹440 per Mbps
The MPLS price at which 10 Mbps MPLS ties with broadband plus SD-WAN
TechBag arithmetic: ₹4,400 ÷ 10 Mbps
38 users
Branch headcount above which SASE at US$7 a user costs more than MPLS
TechBag arithmetic: (₹27,100 − ₹4,400) ÷ ₹595
₹3.27 crore
36-month saving for 40 branches moving from MPLS to broadband plus SD-WAN, before GST
TechBag arithmetic: ₹22,700 × 40 × 36
The first number is the one to put to your carrier. The published rate works out to ₹2,710 per Mbps for a 10 Mbps port; MPLS would have to fall to ₹440 per Mbps, about a sixth, before it tied with two broadband lines and an edge.1 No Indian carrier filing we have seen suggests that is where enterprise MPLS is going; the current TRAI consultation is about whether more providers may sell leased circuits at all, not about cutting them to broadband prices.15
The second is the one to put to your SASE vendor. At US$7 a user the crossover with MPLS is 38 people a branch; at the US$15 and upward per user per month that the fully bundled platforms are reported to cost, it is nearer 18.6 A vendor who will not define a billable user, including contractors and shared devices, has not given you a price. The third number is simply the first two over three years, and it is the figure that pays for the migration, the second line in every branch and the latency testing this piece keeps asking for.
Sources
Related on TechBag: the SASE and SSE guide compares 20 products on which half they sell and where their Indian PoPs are; the Cato hub and the Netskope hub hold the two vendors’ India detail; Cloudflare One is the published-price option used in the example.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.