What Is Your MPLS Really Costing You?
Most IT teams know MPLS is expensive. Fewer have modeled the full cost: circuits, branch security appliance support, and the engineering hours your team spends keeping it running. When you add those up and compare them against a managed SD-WAN path with Aegis, broadband replacement, Cato, or VeloCloud-based SSE, and co-managed operations, the gap is usually larger than the circuit bill alone suggests.
This calculator models a 3-year cost comparison across the three SD-WAN/SASE architectures IVI deploys: VeloCloud + Zscaler, VeloCloud + Palo Alto Prisma Access, and Cato Networks. Enter your current site count, MPLS costs, and security appliance spend. The model shows you where the savings come from, what Aegis managed services cost, and when the implementation investment pays back, with nothing hidden.
Model methodology
This model compares 3-year total cost of ownership between your current MPLS environment and a managed SD-WAN path with Aegis. All VeloCloud hardware prices include 3-year NBD hardware replacement and 24×7 support.
Circuit costs
- Status quo MPLS rates are modeled at typical enterprise averages: $800/mo at 30 Mbps, $1,200/mo at 50 Mbps, $2,000/mo at 100 Mbps. Non-MPLS sites are modeled at the equivalent DIA broadband rate for the selected tier.
- SD-WAN target circuits use DIA broadband ($300 / $400 / $875 per site per month by tier) plus a $100/mo backup broadband circuit providing active failover.
VeloCloud hardware and licensing
- Branch hardware is priced as a 3-year HA pair or single unit. A VeloCloud headend (always HA) is included in all VeloCloud deployments and scales with site count.
- Software licensing is priced per site for a 3-year term by bandwidth tier. Headend bandwidth licensing is calculated from aggregate branch bandwidth at a 6:1 oversubscription ratio.
Cato Networks
- Hardware: standardised $1,800/site Socket (3-year, HA-capable). No separate headend hardware.
- Service: billed monthly per total GB across the environment. The model calculates required GB from site count and bandwidth tier with a 1.25× utilisation factor, minimum 1 GB.
Branch security appliances
- VeloCloud (Architectures A & B): integrated stateful firewall and IPS eliminates approximately 70% of standalone branch appliance cost.
- Cato (Architecture C): cloud-delivered NGFW and SSE eliminates approximately 90% of branch appliance cost.
WAN operations and implementation
- Engineer burdened annual cost modeled at $140,000/FTE with 40% of time on WAN operations. Aegis co-management reduces that operational time by approximately 65%.
- IVI professional services cover design, deployment and cutover. Costs scale with project size and complexity — the model uses representative estimates. Aegis managed service fees are shown as a total; minimum monthly engagement is $2,500.
Not included in this model
- Per-user SSE licensing (Zscaler ZIA/ZPA, Palo Alto Prisma Access, Cato SSE) is excluded. These vary by user count, feature tier, and existing vendor agreements and should be evaluated separately with IVI.