Most businesses today have at least two WAN links: fibre plus broadband, or fibre plus 4G/5G. The intention is clear more resilience and better performance. Yet in many networks, the second circuit ends up doing almost nothing until the day the primary fails.
SD-WAN changes that, but only if it’s configured with the right operating approach. In practice, SD-WAN deployments usually fall into two modes: active and passive. Choosing the right one (or combining both) is what separates a WAN that looks redundant on paper from one that actually delivers a better user experience every day.
Active vs Passive in one sentence
Passive SD-WAN uses a primary link for most traffic and keeps the other links mainly for failover.
Active SD-WAN uses multiple links at the same time and steers traffic based on policy and real link performance.
That’s it. Same circuits, same providers completely different results.
Why the “link down” mindset is outdated
WAN problems rarely look like a clean outage. More often they look like this:
-
the circuit is technically “up”
-
but Teams audio is robotic
-
SaaS pages load slowly
-
remote desktop lags
-
users complain, and monitoring says everything is fine
This is a brownout: the link is alive, but the quality is bad. A good SD-WAN design is built to handle brownouts, not just outages. This is where active and passive behaviours become very different.
Passive SD-WAN: predictable and simple
Passive SD-WAN is the modern version of classic failover. One link carries the workload. The others are there to take over when the primary is no longer acceptable.
It’s a strong choice when you value predictability over optimisation. If your environment depends on stable egress paths—such as IP allow-listing, legacy integrations, or certain payment/banking workflows passive designs can reduce surprises. They’re also easier to operate for small IT teams because routing behaviour is consistent most of the time.
The downside is obvious: you’re paying for capacity that sits idle. More importantly, passive designs can still suffer during brownouts because the primary link may remain “up” even while users feel pain. Quality-based failover improves this, but it still tends to react later than an optimised active approach. And if failover changes public IP or stateful session behaviour, some applications will still experience disruption.
Active SD-WAN: use what you pay for
Active SD-WAN treats each WAN circuit as a resource to be used—continuously. Both links carry traffic, and policies decide what goes where based on live link health.
In an active approach, SD-WAN constantly measures key indicators like latency, jitter, and packet loss and compares them to thresholds you define. Real-time traffic (voice/video) typically needs low jitter and low loss. Business apps often need consistency and low loss. Bulk transfers care about throughput and cost. Active SD-WAN can steer each category accordingly, and when a link starts to degrade, it can move traffic away before users start complaining.
Active designs usually deliver immediate wins: better call quality, faster SaaS, fewer “mystery slowdowns,” and better overall bandwidth utilisation. The trade-off is that active SD-WAN requires good policy design and good visibility. If the rules are unclear, troubleshooting becomes “why did it choose that path?” The solution is not to avoid active SD-WAN it’s to implement it with clean intent, sensible thresholds, and proper monitoring.
The best answer is often “hybrid”
In real networks, the best SD-WAN design is rarely “everything active” or “everything passive.” It’s usually a hybrid model that matches how the business actually operates.
A typical high-quality approach looks like this:
-
Voice & video: active best-path steering (optimise for jitter/loss)
-
Business-critical apps: preferred path with controlled failover (stability first)
-
Bulk traffic (backups/updates): cost-based routing (use cheaper capacity)
-
4G/5G: last resort or emergency path (continuity over performance)
This is where SD-WAN becomes genuinely practical: performance where it matters, predictability where it’s required, and resilience everywhere.
How SD-WAN makes decisions (no hype, just mechanics)
Most SD-WAN platforms follow the same logic:
- Measure link health (latency/jitter/loss, sometimes bandwidth)
- Classify traffic (application, destination, DSCP, segment, user group)
- Steer traffic (prefer, distribute, cost-route, or fail over)
If any of these three are weak poor measurements, generic classification, or vague policies—SD-WAN will behave like “fancy failover” instead of an optimisation engine.
A practical way to choose
If you want a quick decision framework:
-
Choose passive if you need the simplest operations and stable routing behaviour, or your environment has strict egress IP constraints.
-
Choose active if user experience matters (Teams/VoIP, SaaS-heavy work, multi-site workflows) and you want to eliminate brownouts.
-
Choose hybrid if you want the best outcome without creating operational complexity—and most organisations do.
Final thought
SD-WAN isn’t magic. It’s a control system. The difference between a disappointing SD-WAN deployment and a brilliant one often comes down to one decision: are you running it actively, passively, or intelligently combining both?
If you’re paying for multiple WAN links and users still complain about performance, the problem is rarely the circuits. It’s usually the operating mode and policies.
If you’d like, share your setup (number of sites, link types, key applications), and I’ll outline a clean active/passive/hybrid policy model you can use as a starting point.
