--- title: "MPLS costs 6× broadband plus SD-WAN: a 40-branch Indian worked example" summary: "What a 40-branch company pays per branch per month for MPLS, broadband with SD-WAN, and SASE, from published Indian rate cards, plus TechBag's count of each vendor's Indian PoPs. September 2026." url: https://www.thetechbag.com/blog/sd-wan-sase-branch-network-india format: Analysis desk: "Network & SASE" published: 2026-09-22 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["SD-WAN","SASE","SSE","MPLS","branch connectivity","India PoPs","TRAI","RBI","Cloudflare","Netskope","Zscaler","Fortinet","Cato"] cover: https://www.thetechbag.com/blog/covers/sd-wan-sase-branch-network-india.png --- # MPLS costs 6× broadband plus SD-WAN: a 40-branch Indian worked example *What a 40-branch company pays per branch per month for MPLS, broadband with SD-WAN, and SASE, from published Indian rate cards, plus TechBag's count of each vendor's Indian PoPs. September 2026.* Analysis · Network & SASE · By TechBag · Published 2026-09-22 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/sd-wan-sase-branch-network-india The short version - For a 40-branch company, a 10 Mbps MPLS port at the carriers’ published NSE-member rate (**₹27,100** a month) costs about six times two 300 Mbps broadband lines with an SD-WAN edge (**₹4,400**). Over 36 months that is ₹3.9 crore against ₹63 lakh, before GST.[1][4][5] - SASE does not deepen the saving; it spends most of it. Add inspection in a provider’s cloud at US$7 a user and 25 users a branch and the figure is **₹19,200**: still under MPLS, but the bill now follows headcount, not sites.[6] - Which vendor depends on the map, not the brochure. Counting the cities each vendor names in its own documentation, Cloudflare has 22 Indian cities, Zscaler and Netskope five each, Fortinet four, Cato two and Palo Alto one. The question the original version of this piece asked, in December 2025, was why SD-WAN and SASE exist. The better question for an Indian IT head whose carrier MPLS contract is up for renewal is arithmetic: what does each architecture cost per branch per month, what is the money actually buying, and does the provider whose cloud will inspect the traffic have a point of presence anywhere near Nagpur. We have built the example around forty branches of twenty-five people each because that is the shape of the mid-market estate TechBag is asked about most: a regional bank or NBFC, a retail chain, a diagnostics network, a distributor. Every assumption is stated so you can substitute your own invoice. ## The bill: ₹27,100 a branch against ₹4,400 MPLS first. Carriers do not publish enterprise MPLS prices, which is why most comparisons use guesses. The one published rate card we could find is the National Stock Exchange’s chart of what Tata Communications, Bharti Airtel and Vodafone Idea charge its members for MPLS connectivity: for a 10 Mbps port on a single last mile with the router included, Tata and Airtel list ₹3,25,000 a year and Vodafone Idea ₹2,12,000, plus ₹20,000 to ₹25,000 to install.[1] The Tata and Airtel figure is ₹27,083 a month; we have used ₹27,100. A 2026 analysis from a Bengaluru training provider puts metro MPLS at ₹8,000 to ₹15,000 per Mbps per month, which would make the same port ₹80,000 or more.[3] We have deliberately used the lower, published carrier figure. If MPLS is overstated anywhere in this piece, it is not here. Broadband plus SD-WAN next. Two 300 Mbps lines from different ISPs at Airtel’s published ₹1,499 a month each, before GST, come to ₹2,998.[4] The SD-WAN edge is a FortiGate 40F: ₹22,000 of hardware spread over 36 months is ₹611 a month, and the Unified Threat Protection subscription at ₹9,000 a year is ₹750; SD-WAN itself is in FortiOS at no extra licence.[5] That is ₹4,359 a branch a month, rounded to ₹4,400, for thirty times the bandwidth on two physically separate paths, with web filtering and intrusion prevention running at the branch. SASE last. Keep the same two lines and the same edge, and add security service edge at US$7 per user per month, which is Cloudflare’s published pay-as-you-go price beyond its fifty free users and the lowest published dollar list price among the six vendors here.[6] At an assumed ₹85 to the dollar that is ₹595 a user, ₹14,875 for a 25-person branch, and ₹19,234 in total, rounded to ₹19,200. **Figure: Broadband plus SD-WAN is a sixth of the MPLS bill per branch; SASE spends most of that saving on per-user inspection** *Rupees per branch per month before GST, 40 branches of 25 users: 10 Mbps MPLS port vs two 300 Mbps broadband lines with a FortiGate 40F vs the same plus SSE at US$7 a user, September 2026* MPLS, 10 Mbps 27,100 ₹27,100 Broadband + SD-WAN ₹4,359 SASE: SD-WAN + SSE 14,875 ₹19,234 | | MPLS port | Two broadband lines | FortiGate edge and UTP | SSE seats, 25 users | | --- | --- | --- | --- | --- | | MPLS, 10 Mbps | 27,100 | 0 | 0 | 0 | | Broadband + SD-WAN | 0 | 2,998 | 1,361 | 0 | | SASE: SD-WAN + SSE | 0 | 2,998 | 1,361 | 14,875 | Source: NSE rate chart (Tata Communications and Airtel 10 Mbps MPLS); Airtel 300 Mbps published price; Cloudfy Systems FortiGate India pricing; Cloudflare pay-as-you-go price via the TechBag SASE guide; TechBag arithmetic · as of 30 September 2026 · ₹85 to the dollar assumed; totals unrounded (₹4,359 and ₹19,234 in the text's arithmetic); installation, HQ firewall and internet for the MPLS case, 4G failover and staff time excluded TechBag countTechBag arithmetic, and what is left out The three figures are TechBag’s sums from the published prices cited, not quotes. They exclude installation (₹20,000 to ₹25,000 a site for MPLS), the head-office firewall and internet circuit that an MPLS estate still needs to reach SaaS, a 4G or 5G backup, central management tooling and staff time. Every exclusion favours MPLS. GST at 18% applies to all three.[1] Two sensitivities. At Vodafone Idea’s rate MPLS falls to ₹17,700 a month, four times the SD-WAN figure rather than six.[1] And if a branch genuinely needs a line with a service-level agreement, replace one broadband line with a 10 Mbps internet leased line, which Airtel’s own pricing guide puts at ₹8,000 to ₹12,000 a month; the SD-WAN figure becomes ₹10,900 to ₹14,900, still roughly half of MPLS, with the SLA on one leg.[2] ## The mechanism: why the branch stops paying for distance An MPLS circuit is priced the way leased circuits have always been priced in India: by port speed, by distance and by the SLA. TRAI’s own ceiling tariffs for domestic leased circuits are banded by kilometre, and when it cut them by up to 60% in 2014 the headline figure was the 5 to 500 km band for a 2 Mbps E1, from ₹8,50,000 to ₹3,41,000 a year.[14] A broadband line is priced flat: Nagpur pays what Mumbai pays. SD-WAN is the piece of software that lets a company buy the flat-priced thing and still get the behaviour it was paying the distance premium for. **Figure: Four hops replace the hairpin: the branch breaks out locally, the overlay makes two cheap lines behave like one, and inspection moves to a PoP near the user** *How a branch reaches SaaS and the data centre under SD-WAN and SASE, and where each rupee of the ₹19,200 goes* 1. 01Branch: two lines, one edgeTwo 300 Mbps broadband lines from different ISPs terminate on one SD-WAN appliance. Cost: ₹4,359 a month. The appliance measures loss, jitter and latency on both lines every second. 2. 02SD-WAN overlayEncrypted tunnels across both lines to the data centre and to the SSE provider. Application-aware steering sends voice and ERP down the healthier path and moves them in under a second when a line degrades. 3. 03SSE or SASE PoPWeb, SaaS and private-app traffic is inspected in the provider’s nearest point of presence, where the user is, not at head office. Cost: ₹595 a user a month at US$7. PoP distance is the user experience. 4. 04SaaS, cloud, data centreMicrosoft 365, the core banking or ERP system, and the public cloud are reached from the PoP, not back through a central firewall. The head-office circuit stops carrying every branch’s internet. Source: TechBag SASE and SSE guide; vendor architecture documentation for Fortinet, Cato, Cloudflare, Zscaler and Netskope · as of 30 September 2026 The economic consequence is in step three. Under MPLS the security sits at head office and every branch pays, in distance, to reach it. Under SASE the security sits in a provider’s PoP and every user pays, per seat, to be inspected there. The first bill scales with sites and kilometres; the second with people. That is why the worked example flips: forty small branches are cheap to connect and expensive to inspect, and a company with four large branches would find the opposite. ## The India map: who has a PoP near your branch Every SASE vendor publishes a global map. Far fewer publish a list of Indian cities, and the list is the only thing that matters for a branch in Coimbatore, because a user whose traffic is inspected in Mumbai or, worse, Singapore notices it on every click. We counted the distinct Indian cities each of six vendors names in its own documentation or press statements, and nothing else. **Figure: Cloudflare names 22 Indian cities; no other SASE vendor names more than five** *Distinct Indian cities with a point of presence named in the vendor's own documentation or press statements, TechBag count, September 2026* Cloudflare of 348 cities worldwide 22 cities Zscaler (zscaler.net cloud) Chennai, Hyderabad, Kolkata, Mumbai, New Delhi 5 cities Netskope NewEdge Mumbai, Delhi, Kolkata, Hyderabad, Chennai 5 cities Fortinet FortiSASE Bangalore, Pune (limited), Delhi, Mumbai 4 cities Cato Networks Chennai, Mumbai 2 cities Palo Alto Prisma Access Mumbai named; otherwise regions 1 cities | | Value (cities) | | --- | --- | | Cloudflare | 22 | | Zscaler (zscaler.net cloud) | 5 | | Netskope NewEdge | 5 | | Fortinet FortiSASE | 4 | | Cato Networks | 2 | | Palo Alto Prisma Access | 1 | Source: Cloudflare network page; Zscaler cloud enforcement node list for zscaler.net; Fortinet FortiSASE 7.4 Reference Guide; Netskope via SecurityBrief (May 2025) and IT Brief India (April 2026); Cato and Palo Alto as documented on their TechBag hubs · as of 30 September 2026 · cities, not nodes or regions: Zscaler's 5 cities carry 9 nodes, Netskope's 5 carry 8 data centres, Fortinet's 4 carry 5 PoPs Cloudflare’s network page lists 22 Indian cities among 348 worldwide, including Nagpur, Patna, Coimbatore, Bhubaneswar, Jalandhar, Kannur and Udaipur, and the company’s architecture runs every service in every city.[7] Zscaler’s enforcement-node list for its zscaler.net cloud names nine Indian nodes in five cities, three each in Chennai and Mumbai.[8] Netskope reached eight Indian data centres in May 2025, across Mumbai, Delhi, Kolkata, Hyderabad and Chennai, and in April 2026 added a Mumbai management plane so that policy, configuration, metadata and logs can stay in India.[10][11] Fortinet’s FortiSASE reference guide lists five Indian security PoPs in four cities out of 99 worldwide, with Pune marked limited availability.[9] Cato operates two of its 85-plus PoPs in Chennai and Mumbai.[12] Palo Alto has documented a Mumbai cloud location for Prisma Access since 2021 and otherwise publishes compute locations by region, so one named city is what the rule allows it.[13] TechBag countHow the cities were counted A city counts once if the vendor names it as a point of presence, data centre or enforcement node in its own documentation, status page or press statement. Regions such as “India West” do not count; a second node in the same city does not count; a reseller’s claim does not count. Zscaler runs several clouds with different lists, so its count is for zscaler.net only. The counts say where traffic can be inspected, not where logs are stored; only Netskope documents the second in India.[11] For a forty-branch estate the reading is blunt. If your branches are in the five metros, every vendor on the chart can serve them from in-country. If they are in Nagpur, Indore, Raipur, Madurai or Guwahati, the honest shortlist for SSE is shorter than the Gartner quadrant, and the first procurement step is a latency test from three of your own branches, not a feature demo. The[SASE and SSE guide](https://www.thetechbag.com/browse/network-security-sase/sase-sse) sets out that test and the contract clauses that go with it. ## SD-WAN alone or SASE: what the extra ₹14,900 a branch buys The SASE bar is ₹14,900 a branch a month above SD-WAN alone, ₹5.95 lakh a month across forty branches. In the worked example the FortiGate at each branch already filters web traffic and runs intrusion prevention, so the honest question is what inspection in a provider’s cloud adds to inspection in a box. **Figure: SASE buys inspection that follows the person out of the branch; SD-WAN alone buys cheaper, faster lines for the people who stay** *What each architecture includes at the branch in the worked example, and where its bill grows, September 2026* SD-WAN alone: ₹4,400 a branch - Two broadband paths with application-aware failover; the branch stays up when one ISP fails - Web filtering, intrusion prevention and antivirus in the branch appliance (the UTP bundle) - Security stops at the branch door: a laptop at home or a contractor on a phone is outside it - TLS decryption limited by a small appliance; in practice it gets scoped down under load - Bill grows with sites; headcount is free; all billed in INR by Indian partners SASE: ₹19,200 a branch at 25 users - The same two lines and edge, so the connectivity saving against MPLS is kept - Inspection in a PoP, at PoP scale, for every user wherever they are: branch, home, airport - One policy across web, SaaS, private apps and data loss; ZTNA replaces the branch-to-HQ VPN - Logs centralised at the provider; ask where they are stored, because only Netskope documents India - Bill grows with users, including contractors; most vendors bill in US dollars Source: TechBag SASE and SSE guide; Fortinet FortiGate UTP bundle contents via Cloudfy Systems; Cloudflare One, Netskope and Zscaler product documentation as summarised on their TechBag pages · as of 30 September 2026 Our view Our view: if the twenty-five people in each branch work from the branch, SD-WAN alone with a capable edge is the right purchase, and the ₹5.95 lakh a month is better spent on the second line and a proper management console. If a meaningful share work from home or the field, the branch firewall is protecting furniture, and SASE is the architecture. Either way, buy the SSE half first and let the vendor earn the SD-WAN half by showing a branch where the WAN itself is the problem. The most common overspend in this category is a SASE bundle sold to an estate whose WAN was fine. ## Three numbers to check before you believe mine A worked example is only as good as its assumptions, so here are the three points at which this one breaks, each of which you can test against your own invoices in an afternoon. ₹440 per Mbps The MPLS price at which 10 Mbps MPLS ties with broadband plus SD-WAN TechBag arithmetic: ₹4,400 ÷ 10 Mbps 38 users Branch headcount above which SASE at US$7 a user costs more than MPLS TechBag arithmetic: (₹27,100 − ₹4,400) ÷ ₹595 ₹3.27 crore 36-month saving for 40 branches moving from MPLS to broadband plus SD-WAN, before GST TechBag arithmetic: ₹22,700 × 40 × 36 The first number is the one to put to your carrier. The published rate works out to ₹2,710 per Mbps for a 10 Mbps port; MPLS would have to fall to ₹440 per Mbps, about a sixth, before it tied with two broadband lines and an edge.[1] No Indian carrier filing we have seen suggests that is where enterprise MPLS is going; the current TRAI consultation is about whether more providers may sell leased circuits at all, not about cutting them to broadband prices.[15] The second is the one to put to your SASE vendor. At US$7 a user the crossover with MPLS is 38 people a branch; at the US$15 and upward per user per month that the fully bundled platforms are reported to cost, it is nearer 18.[6] A vendor who will not define a billable user, including contractors and shared devices, has not given you a price. The third number is simply the first two over three years, and it is the figure that pays for the migration, the second line in every branch and the latency testing this piece keeps asking for. If you are buying this in India **The telecom rules explain the price gap.** Under DoT licensing a leased circuit or MPLS VPN comes from an access or national long-distance licensee, not from an internet service provider, which is why the company that sells you cheap broadband cannot sell you the MPLS and why the MPLS market has two or three sellers in most cities. TRAI’s Consultation Paper 01/2026 of 23 January 2026 asks whether ISPs should be allowed to provide domestic leased circuits and how that would affect tariffs.[15] TRAI caps point-to-point leased-circuit prices by distance band, last cut by up to 60% with effect from 1 August 2014, but MPLS VPN circuits sit outside those ceilings, and industry responses to the 2026 paper ask that they stay there.[14][16] Nothing in that paper is a decision; do not price a renewal on it. **For banks and NBFCs the second line is an obligation, not a luxury.** RBI’s Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices of 7 November 2023, in force from 1 April 2024, requires regulated entities to ensure BCP and DR capabilities in “critical interconnected systems and networks”, to mitigate single points of failure in third-party arrangements, and to run DR drills for critical systems at least half-yearly.[17] A branch on one MPLS port is a single point of failure by definition; two broadband lines from different ISPs under an SD-WAN overlay are the cheapest way I know to remove it, and the drill is a cable you unplug. **Logs and residency.** CERT-In’s Directions of 28 April 2022 require ICT logs to be kept for 180 days within India.[18] When inspection moves to a SASE PoP the logs move with it, so ask every vendor, in writing, where they are stored; Netskope is the only one of the six that documents an in-India management plane for policy and log data, since April 2026, and names the DPDP Act, RBI and SEBI’s CSCRF as the reasons.[11] On money: every figure above is before GST at 18%. MPLS and broadband are billed in rupees by the carrier; most SASE vendors bill in US dollars, so the ₹85 assumption in the worked example is yours to replace with your treasury’s rate. TechBag quotes SD-WAN edges and SSE seats in rupees with GST, and will run the latency test from your branches before a quote. How we did this Figures as of 30 September 2026 The MPLS rate is the National Stock Exchange’s published chart of carrier charges for member MPLS connectivity; the document is undated, names Vodafone Idea and so post-dates August 2018, and covers wireless last-mile delivery with the router included. I treated it as the floor and cited the higher 2026 per-Mbps estimate alongside it. Broadband is Airtel’s published 300 Mbps price, stated before GST in 2022 and used unchanged; the FortiGate figures are the top of the ranges in a June 2026 Indian reseller guide; the US$7 SSE price is Cloudflare’s pay-as-you-go list as recorded on TechBag’s SASE guide. The ₹85 exchange rate, the 25-user branch and the 36-month amortisation are assumptions, not facts. PoP cities were counted from each vendor’s own documentation or dated press statements as described in section 3; Cato’s and Palo Alto’s lists are as documented on their TechBag hubs because the vendors’ map pages do not render as text. The RBI Direction was read on rbi.org.in; the ASSOCHAM filing’s position on MPLS VPN is taken from TRAI’s published copy. No vendor quote, customer or latency figure is implied. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [National Stock Exchange, Rate chart of service providers: wired and wireless POP and MPLS connectivity (Tata Communications, Bharti Airtel, Vodafone Idea)](https://archives.nseindia.com/content/members/Rate_chart_of_service_providers_wired_wireless_POP_MPLS_connectivity.pdf) — undated; names Vodafone Idea, so after August 2018 Annual recurring charges per port, router included. 2. [Airtel Business, Are you overpaying for your internet? What really affects leased line pricing](https://www.airtel.in/b2b/insights/blogs/are-you-overpaying-for-your-internet-understand-what-really-affects-leased-line-pricing) — 20 August 2025 3. [NetworkersHome, SD-WAN vs MPLS: cost and performance analysis (India)](https://networkershome.com/fundamentals/sd-wan/sd-wan-vs-mpls-cost-performance-analysis/) — updated March 2026 A training provider's estimate, cited as the upper reference only. 4. [TelecomTalk, Airtel Xstream Fiber 300 Mbps and 1 Gbps plans, prices before GST](https://telecomtalk.info/airtel-xstream-fiber-broadband-plans-made-for/502609) — 4 March 2022 5. [Cloudfy Systems, Fortinet FortiGate pricing in India (40F to 100F, UTP bundles, 18% GST)](https://cloudfysystems.com/blog/fortinet-fortigate-pricing-india) — 11 June 2026 6. [TechBag, SASE and SSE: how to choose, and which half (Cloudflare US$7 pay-as-you-go; FortiSASE US$8–18 list band; reported per-user bands)](https://www.thetechbag.com/browse/network-security-sase/sase-sse) — as of September 2026 7. [Cloudflare, Our global network (data centre locations by region)](https://www.cloudflare.com/network/) — undated page 8. [Zscaler, Cloud enforcement node ranges for zscaler.net](https://config.zscaler.com/zscaler.net/cenr) — undated page 9. [Fortinet, FortiSASE 7.4 Reference Guide: Global data centers](https://docs.fortinet.com/document/fortisase/latest/reference-guide/663044/global-data-centers) — undated page 10. [SecurityBrief Asia, Netskope expands in SAARC with leadership promotion and new centres (eight Indian data centres across five cities)](https://securitybrief.asia/story/netskope-expands-in-saarc-with-leadership-promotion-new-centres) — 8 May 2025 11. [IT Brief India, Netskope launches Mumbai management plane for Indian data](https://itbrief.in/story/netskope-launches-mumbai-management-plane-for-indian-data) — 17 April 2026 12. [TechBag, Cato Networks hub (PoPs in Chennai and Mumbai, 85-plus worldwide, from Cato's published backbone list)](https://www.thetechbag.com/cato) — as of September 2026 13. [TechBag, Palo Alto Prisma SASE intel page (Mumbai cloud location documented since 2021; India West fallback)](https://www.thetechbag.com/palo-alto/prisma-sase) — as of September 2026 14. [tele.net, TRAI revises ceiling tariffs for domestic leased circuits (cut of up to 60%, effective 1 August 2014)](https://tele.net.in/trai-revises-ceiling-tariffs-for-domestic-leased-circuits/) — 16 July 2014 15. [TeamLease RegTech, TRAI issues Consultation Paper No. 01/2026 on the review of tariff for Domestic Leased Circuits](https://teamleaseregtech.com/updates/article/52355/trai-issued-a-consultation-paper-on-the-review-of-the-tariff-for-domestic-leased-circuits-dlcs/) — 23 January 2026 (paper); 3 February 2026 (summary) 16. [ASSOCHAM, Response to TRAI Consultation Paper on Domestic Leased Circuits (MPLS VPN to remain outside tariff regulation)](https://www.trai.gov.in/sites/default/files/2026-03/ASSOCHAM_10032026.pdf) — 10 March 2026 17. [Reserve Bank of India, Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107)](https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=12562) — 7 November 2023; in force 1 April 2024 18. [CERT-In, Directions under section 70B(6) of the IT Act (180-day log retention)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 Related on TechBag: the [SASE and SSE guide](https://www.thetechbag.com/browse/network-security-sase/sase-sse) compares 20 products on which half they sell and where their Indian PoPs are; the [Cato hub](https://www.thetechbag.com/cato) and the [Netskope hub](https://www.thetechbag.com/netskope) hold the two vendors’ India detail; [Cloudflare One](https://www.thetechbag.com/cloudflare/cloudflare-one-zero-trust) is the published-price option used in the example. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [SASE and SSE guide: which half to buy, and the India PoP map](https://www.thetechbag.com/browse/network-security-sase/sase-sse) — 20 products on scope, bundled modules, India PoPs and log residency, with the latency test this piece asks for - [Cato Networks hub](https://www.thetechbag.com/cato) — the owned-backbone SASE with PoPs in Chennai and Mumbai; quote-only - [Netskope hub](https://www.thetechbag.com/netskope) — eight Indian data centres and the Mumbai management plane for in-country policy and logs