Why UK CIOs Are Terminating MPLS Contracts
Replacing a legacy 50Mbps MPLS circuit with dual carrier-diverse links (1Gbps Dedicated Internet Access paired with a secondary business FTTP or 5G bearer) orchestrated by Managed SD-WAN delivers 10x to 20x higher bandwidth while reducing recurring WAN operating spend by 40% to 55%.
1. The Economic Breakdown: SD-WAN vs MPLS Cost in the UK
Historically, enterprise network teams relied on MPLS because it provided deterministic Quality of Service (QoS) with strict packet prioritisation across a private carrier core. However, telecom providers leveraged this lock-in to charge premium rates for modest bandwidth allocations.
In the UK today, a standard 50Mbps or 100Mbps MPLS connection with strict SLA packaging costs between £800 and £1,500 per month per site. In contrast, wholesale fibre deregulation via Openreach Physical Infrastructure Access (PIA) and alternative network rollouts allows businesses to light uncontended 1Gbps Dedicated Internet Access (DIA) for £280 to £380 per month.
| Architecture Component | Legacy MPLS (5-Site Estate) | Managed Dual SD-WAN + FWaaS |
|---|---|---|
| Primary Bearer Throughput | 50 Mbps to 100 Mbps Committed | 1 Gbps Symmetrical (1:1 DIA) |
| Secondary Resiliency Link | Cold Standby ADSL/FTTC (Idle) | Active-Active 1Gbps FTTP / 5G |
| Monthly Circuit Spend (5 Sites) | £5,250 / month (£1,050/site) | £1,750 / month (£350/site) |
| Managed Edge & Security | Separate central firewall add-on | £1,850 / month (FortiGate FWaaS) |
| Total Annual WAN OPEX | £63,000 / year | £43,200 / year |
| Net Annual Enterprise Savings | — | Save £19,800/yr (31% • +20x Speed) |
To model exact cost differentials and hardware sizing across your specific branch count and bandwidth commitments, consult our interactive Firewall & SD-WAN Throughput Sizer, which models x86 vs hardware ASIC decryption and TCO savings.
2. The Technical Penalty: The Cloud Trombone / Hairpin Problem
Beyond cost, the primary architectural limitation of MPLS is its hub-and-spoke topology. When remote branch offices access modern cloud platforms—such as Microsoft 365, Teams, Salesforce, Zoom, or AWS—MPLS forces that traffic across a private link back to corporate headquarters before egressing to the public internet.
- Latency Hairpinning: A branch user in Manchester accessing Microsoft Azure (UK South in London) experiences traffic routed Manchester → Leeds HQ → London Data Centre → Azure, adding 25ms to 50ms of round-trip latency.
- HQ Firewall Bottlenecks: Backhauling branch internet traffic saturates headquarters WAN links and overwhelms central firewalls with TLS 1.3 decryption processing.
- Direct Internet Access (DIA) Advantage: Managed SD-WAN enables Local Internet Breakout. Trusted SaaS traffic (M365, Teams) egresses directly at the branch over wire-speed fibre, while internal enterprise traffic routes securely over dynamic IPsec overlays.
3. Dual-Hub SD-WAN Architecture: Sub-Second Active-Active Resiliency
Enterprises migrating from MPLS require enterprise-grade reliability. Single-line broadband or cold standby 4G failover is inadequate for financial institutions and mission-critical operations.
ManagedByUs builds resilient Dual-Hub Active-Active SD-WAN topologies anchored in major UK metro interconnect facilities:
SD-WAN edge appliances continuously probe jitter, latency, and packet loss on both circuits. If the primary circuit incurs packet loss exceeding 0.5%, traffic shifts dynamically in under 500ms.
For sensitive VoIP SIP trunks and video conferencing, Forward Error Correction duplicates audio packets across both active paths. Dropped packets on one link cause zero audible degradation.
4. Security Architecture: Why Managed FortiGate ASIC Acceleration Matters
When decentralising internet breakout to branch sites, each location requires Next-Generation Firewall (NGFW) security. However, deploying unaccelerated software firewalls creates an immediate bandwidth bottleneck.
Over 90% of enterprise web traffic is encrypted under TLS 1.3. When deep SSL inspection is enabled, standard general-purpose CPU firewalls drop throughput by up to 78%. ManagedByUs deploys FortiGate as a Service (FWaaS) powered by dedicated FortiASIC CP9 and NP7 processors:
- Silicon-Level Cryptography: Dedicated content processors offload TLS 1.3 decryption and AES-256 cipher computation into hardware silicon, sustaining true 1Gbps and 10Gbps wirespeed under full threat protection.
- Integrated SD-WAN & ZTNA: FortiOS combines SD-WAN path orchestration, NGFW threat protection, and Zero Trust Network Access (ZTNA) into a single operating system, eliminating branch appliance sprawl.
- Zero Hardware CAPEX: Under our managed FWaaS model, all appliances, High-Availability (HA) pairs, hardware replacements, and 24/7 UK NOC patching are bundled into an OPEX subscription.
5. The 4-Phase Zero-Downtime MPLS Migration Playbook
A migration from legacy MPLS must never cause business interruption. Our network architects execute transitions using a phased parallel-overlay methodology:
Underlay Provisioning & PIA Survey
We conduct site surveys and provision secondary enterprise DIA connections using Openreach PIA and altnets. Circuits are lit and soak-tested without altering existing MPLS CE routers.
SD-WAN Edge Staging & Dual-Hub Overlays
Pre-configured FortiGate appliances are installed on-site. Dynamic IPsec tunnels establish back to our metro core hubs (Telehouse North and Equinix MA1). BGP routing adjacencies are configured in listen mode.
Progressive Traffic Cutover & SLA Tuning
Using BGP Local-Preference and AS-Path manipulation, non-critical SaaS and guest traffic are routed over the new SD-WAN underlay. Once validated, ERP, database, and voice traffic are migrated with sub-second rollback capabilities.
MPLS Decommissioning & Contract Cease
The legacy MPLS network is cleanly severed. Our NOC provides formal documentation and test evidence for telco contract termination, stopping recurring billing immediately.