How to choose between SD-WAN providers in India (2026): criteria, red flags and a shortlist checklist

Many "best SD-WAN vendor" lists are written for US buyers. Indian tenders and bank RFPs add their own filters. Score every bidder on these.

1. MTCTE certification. Notified telecom equipment needs a TEC certificate before it is sold or used in India (TEC). Certification is per model. Check the exact model number on the MTCTE portal. Read is MTCTE mandatory for routers.
2. Class-I local content (PPP-MII). Government, PSU and many public-sector bank tenders give purchase preference to Class-I local suppliers. Suppliers self-certify local content for the item offered, with an auditor certificate above Rs 10 crore. See Class-I local supplier and PPP-MII.
3. Controller and log location. Can the controller run in your own DC and DR, or be hosted in India? CERT-In requires 180 days of ICT logs within India. Banks also answer to RBI's 31 July 2026 Directions; see our RBI Directions guide and CERT-In log retention.
4. 4G/5G at the edge. Many Indian branches and ATMs depend on cellular links. Check built-in dual-SIM or dual-modem options, private APN support and per-SIM signal monitoring.
5. Security on the same platform. Decide whether you want a firewall (NGFW) on the SD-WAN edge and cloud security (SSE/ZTNA) under the same vendor, or separate products.
6. Who runs it, and how you pay. Self-run with your own team, co-managed with the OEM's NOC, or fully managed per site per month. Price the whole five-year term, including licences, NOC and penalties.

Bank RFPs add two more. They expect SD-WAN to be "transport agnostic" across MPLS, ILL, broadband, LTE and VSAT, with SD-WAN and non-SD-WAN sites working together during migration. They also ask for OEM spares in at least 50 Indian cities and parts for seven years (JKB e-RFP). See our SD-WAN RFP clauses for Indian banks.

Indian OEM

Designs its own edge hardware and software, and usually sells direct and through Indian system integrators.

• Pros: can declare Class-I local content; MTCTE on its own models; controller often available on-premises or hosted in India; engineering and support in the same time zone; faster changes for Indian needs such as dual-SIM, private APN and GeM formats.
• Cons: smaller global footprint; check the depth of each security feature and the size of its NOC and field team.

Global vendor

A multinational platform sold in India through distributors, partners and service providers.

• Pros: large installed base worldwide; wide integration catalogue; strong fit if you already run that vendor's products elsewhere.
• Cons: local-content class, MTCTE per model and controller location vary by product, so ask for documents; cloud controllers and log stores may sit outside India unless stated; licence costs at renewal can change the five-year total.

Telecom or managed provider

Runs SD-WAN for you, bundling links, devices and operations under one contract, usually on an OEM's platform.

• Pros: one contract and one SLA for link, box and operations; suits lean IT teams; fast rollout where the carrier already has links.
• Cons: less control over platform choice; ask which OEM sits underneath, whether you can use other carriers' links, and what happens to devices and configuration if you exit.

For a fuller version you can send to bidders, use the 20-point SD-WAN and SASE vendor scorecard, with a spreadsheet download.

Give each bidder 0 (no), 1 (partly or on request) or 2 (yes, with a document). Weight the rows that matter most to you.

• A "Made in India" line on a website, but no local-content declaration for the item you are buying.
• An MTCTE certificate that covers some models, offered as cover for all of them.
• Controller or logs only in an overseas cloud, with no in-India or on-premises option.
• Throughput quoted with security features off.
• Year-one pricing only, with renewal licences "on request".
• No named NOC location, or no spares commitment in the cities where you have branches.
• No pilot on your own sites before the award.

1. Which router models are on your MTCTE certificate, and what is the certificate number?
2. Will you give a Class-I local-content declaration for each BoQ line, with the location of value addition?
3. Can the controller run in our DC and DR? If hosted, in which Indian region?
4. Where are logs stored, and can we export them to our SIEM for 180 days?
5. What throughput do you deliver with firewall, IPS and antivirus all on?
6. Which 4G/5G models support dual-SIM, private APN and per-SIM monitoring?
7. What key exchange do your IPsec tunnels use today, and do you support ML-KEM?
8. Where is your NOC, and in how many Indian cities do you hold spares?
9. What is the five-year cost, including renewals, and what are the uptime penalty bands?
10. If we exit, what happens to the devices, configuration and logs?

Write down your transport mix first. If most branches depend on cellular, weight router quality heavily (see our VSAT to 4G/LTE ATM guide). Decide who runs the network. Filter on paperwork: MTCTE numbers, local-content declarations and controller hosting. Then pilot 10 to 50 of your own branches on two options and price the full term. Our SD-WAN vs MPLS cost guide shows a worked rupee model.

Nexapp is an Indian SD-WAN OEM in Pune, in production since 2014. Here is how it answers the checklist above:

• Class-I local supplier under the PPP-MII Order, with a local-content declaration and certificate for each bid. See certifications.
• Own hardware and firmware. Instaroute 4G/5G routers and SD-WAN edges run Nexapp's own NexappOS operating system.
• MTCTE on listed models. TEC certificate 244903206, valid to 23 March 2035, covers nine Instaroute models, including the IR1100 series, the ODU models and the IRX100-5G. It does not cover the IRX100-5Gv2 or the Enterprise X Series. See trust.
• Firewall and SSE on one platform. NGFW with IPS, gateway antivirus, web filtering and application control on the SD-WAN edge, and SSE/ZTNA for users, under one vendor.
• Management in India. The controller runs in your own DC and DR, or Nexapp-hosted in India.
• Post-quantum at every site. IKEv2 tunnels use hybrid classical + ML-KEM key exchange (NIST FIPS 203). See post-quantum cryptography.
• Buy it or run it as a service. Self-run, managed services, or the whole network per site per month under network as a service.
• Scale and support. 75,000+ devices deployed for 400+ enterprise and banking customers, with a 24×7 NOC in Pune. See customers.