SD-WAN over 5G: Building Resilient Branch Networks

A 5G link on a branch router is no longer a backup-of-last-resort. In 2026, with midband coverage, 5G-Advanced features, and SD-WAN overlays that can score and steer around wireless jitter, 5G is a credible primary underlay for retail, QSR, healthcare, and pop-up industrial branches. This guide walks through the three link modes, the health-check policies that actually work, the 5G edge router hardware checklist, and the realistic limits you still have to plan around.

 

 

Published 2026-06-23 by the InHand Networks Technical Team. 12 min read.

What 'SD-WAN over 5G' means and why 5G is a credible branch underlay in 2026

SD-WAN over 5G is a transport-independent SD-WAN overlay that uses 5G NR (with 4G LTE fallback) as one of its underlay links, alongside MPLS, broadband, or a second cellular carrier. The overlay is typically IPsec, WireGuard, GRE, or a vendor-proprietary tunnel; the underlay is the raw 5G or LTE transport. The SD-WAN controller scores each underlay on live health-check metrics and steers traffic per application, not on a static primary/backup config.

What changed in the last three years is the underlay. Enterprise-grade 5G fixed wireless access (FWA) for business commonly delivers 100 to 300+ Mbps on midband (C-band) coverage, with sub-10 ms latency in well-provisioned cells. Provisioning dropped from 30 to 90 days for an MPLS circuit to days or hours for a 5G SIM and a self-install antenna. In the United States, the three major MNOs (Verizon, T-Mobile, AT&T) all have 5G midband live in the major metro areas, and 5G SA cores are now operating in all three. That is the underlay foundation that turns 'cellular backup' into 'cellular-first'.

Why SD-WAN is still required on top of 5G: a 5G link on its own has more jitter and more variability than fibre. The SD-WAN overlay does not eliminate that variability, but it scores the link on latency, jitter, and packet loss in real time, and it steers voice and Teams off the path the moment the score crosses a policy threshold. 5G is the underlay, SD-WAN is the policy that makes the underlay acceptable for real-time traffic.

For a typical cloud-first branch in 2026 - a retail store, a quick-service restaurant, a bank branch, a healthcare clinic, a pop-up industrial site - the SD-WAN topology is now: 5G as the primary, a wireline broadband circuit (cable, DSL, fibre) as the backup, the SD-WAN overlay managing both. The decision is rarely '5G or MPLS' any more; it is 'which 5G edge router, which SD-WAN overlay, which policy thresholds'.

Once you commit to a 5G SD-WAN branch, the first real question is which link mode the design needs. There are three, and the choice cascades into the firmware feature set, the SD-WAN overlay, and the upstream link configuration of the 5G edge router.

Mode What it does What you actually get on LTE/5G Best fit
Load balancing Distributes new sessions across links (per-flow rules). More total throughput across many users and apps. A single TCP/UDP flow stays on one link. Busy sites with mixed traffic: POS plus guest Wi-Fi, field office uploads, multi-user trailers.
Active-active SD-WAN Uses multiple links with app-aware steering and health checks. Better uptime and app performance. Real-time apps move to the healthier link when loss or jitter rises. Teams, Zoom, VoIP, VDI, and any site where 'degraded' is as bad as 'down'.
Link bonding (SpeedFusion, SD-WAN bonding, etc.) Combines links at the packet level using a tunnel to a bonding endpoint. One flow can use multiple links, and packet duplication can mask loss. Requires a compatible hub, cloud gateway, or concentrator. Live video, critical remote access, high-loss RF environments, moving vehicles.

Most 5G SD-WAN branches land on active-active. Load balancing is what a dual-WAN consumer router does; it does not give you per-flow aggregation and it does not steer real-time traffic off a degraded link. Link bonding is the right tool for a specific set of problems (live uplink from a moving vehicle, a high-loss cell edge where packet duplication pays for itself) but it adds tunnel overhead, raises data usage, and needs a bonding endpoint on the far side.

Common mistake: turning on link bonding because the marketing says it doubles bandwidth. Bonding does not create free bandwidth. If both 5G links sit on the same tower sector, congestion hits both at once. For a typical branch, active-active SD-WAN with well-tuned health checks is the right answer. Reach for bonding only when the failure mode is 'one specific flow cannot tolerate loss'.

Health checks, BFD, and policy-driven failover

Cellular links can look 'up' at the interface level while real traffic is suffering from rising latency, jitter, or packet loss. SD-WAN avoids that trap by continuously scoring each path and moving sessions when the score crosses a policy threshold. The mechanism underneath the score is a health check on each upstream link, and the right protocol for sub-second detection is BFD.

What BFD actually does

BFD (Bidirectional Forwarding Detection) is defined in RFC 5880, with IP-routed single-hop and multihop variants in RFC 5881 and RFC 5883. The router sends BFD control packets at a configured interval (typically 100 ms); if it misses three in a row, the session goes down. With a 100 ms transmit interval and a 3x multiplier, a 5G link failure is detected in roughly 300 ms, vs 1 to 10 seconds for ICMP-based probing. BFD is the standard health-check mechanism for SD-WAN overlays on cellular links, especially where the operator needs brownout detection (the link stays up but app performance has collapsed).

Health-check thresholds that actually work on 5G

The thresholds below come from deployed 5G SD-WAN policies in retail, QSR, and industrial branch rollouts. They are not vendor-specific. They are useful as a starting point and need to be tuned against the actual underlay behaviour at the site.

Traffic class Fail-over trigger Hold-down before failback
Voice and video (Teams, Zoom, SIP/RTP, VDI) Loss > 2-3% for 10-20 s, or jitter > 30-50 ms for 10-20 s. 2-5 minutes.
Transactional apps (POS, EMR, RDP/SSH, site-to-site VPN) Loss > 5% for 20-30 s, or latency > 200-300 ms for 30-60 s. 5-10 minutes.
Bulk traffic (Windows Update, iCloud/OneDrive sync, camera uploads) Pin to the cheapest link; throttle hard when 5G is active; do not fail over on transient loss. N/A (never fail over).

Hysteresis matters as much as the threshold. Without a hold-down timer, the SD-WAN overlay flapps between 5G and broadband every time the 5G link recovers for 30 seconds, and Teams calls drop twice in five minutes. Most 5G SD-WAN policies keep the failback threshold a tier above the failover threshold (e.g., fail over on loss > 2%, fail back on loss < 1% for 5 minutes straight) and rate-limit bulk traffic away from 5G by default.

The 5G edge router hardware checklist

The SD-WAN overlay is only as good as the 5G edge router underneath it. The checklist below is the minimum for a 5G SD-WAN branch in 2026; anything missing is a future truck roll.

1. Dual-SIM with policy-driven SIM switch

Single-SIM 5G is a single point of failure on the carrier side. A 5G SD-WAN edge needs two physical SIM slots, the ability to set priority and force SIM selection, and the ability to switch SIMs on a signal threshold or a monthly data cap. The InHand IR624 has a drawer-style dual-NANO SIM slot plus an optional 1.8 V/3 V eSIM, and exposes a SIM traffic policy with three actions on a threshold: notification only, cloud-management-only, and switch to the other SIM.

2. Signal-quality telemetry exposed to the controller

SD-WAN reacts to loss and latency, but RF quality drives both. The edge router must expose RSRP, RSRQ, SINR, and band information to the SD-WAN controller, so that brownout detection is grounded in real RF data, not just IP-layer probes. The IR624 exposes these on its local web UI and on the InHand Device Manager cloud dashboard.

3. IPsec plus WireGuard and L2TP VPN

The SD-WAN overlay tunnel is usually IPsec, WireGuard, or both. The edge router must run both natively (not via a slow software add-on) and the VPN throughput must be published in the datasheet. WireGuard is line-rate on most modern router CPUs; IPsec with AES-256 typically sits at 200-400 Mbps. The IR624 supports IPSec, L2TP, PPTP, OpenVPN, GRE, and WireGuard in firmware.

4. Three upstream link types with link backup and load balancing

A pure 5G-only edge is a fragile design. A 5G SD-WAN edge should support at least three upstream types: WAN Ethernet (for the wireline broadband or fibre circuit), 5G/4G cellular, and Wi-Fi STA (to join an existing Wi-Fi as a third underlay). Link backup (active/passive) and load balancing (active/active across the three) should both be configurable. The IR624 supports exactly this set, with link detection on latency, jitter, packet loss, and signal strength.

5. Industrial hardening for the site class

A retail branch in a climate-controlled mall needs -10 to +50°C and IP20 indoor housing (the FWA12 fits this). A rooftop industrial cabinet, a remote lift station, a wellhead, a vehicle, or a roadside cabinet needs -20 to +70°C, IP30 or better, EMC level 3, 1.5 kV Ethernet isolation, fan-less metal housing, and DIN-rail or wall mounting. The IR624 is the reference point for that site class.

IR624: 5G SD-WAN edge for harsh industrial branches

InHand IR624 - 5G industrial router for SD-WAN edge

5G NR sub-6 with downlink up to 2 Gbps and 4G LTE fallback. 880 MHz CPU, 256 MB RAM, 128 MB Flash. 4 x 10/100/1000 Mbps Ethernet with 1.5 kV network isolation, DC 9-48 V input, 1 x RS-232 + 1 x RS-485, dual-NANO SIM drawer with optional eSIM, 4 x SMA for 5G (2 x for 4G) plus 2 x RP-SMA for Wi-Fi. IPSec/L2TP/WireGuard/OpenVPN/GRE/PPTP VPN. IP30 metal housing, fan-less, -20 to +70°C operating, EMC level 3, DIN-rail or wall mount. FCC, IC, PTCRB, Verizon, T-Mobile, AT&T carrier certified.

Three upstream link types (WAN, cellular, Wi-Fi STA) with link backup and load balancing modes, and a SIM traffic policy (notification / cloud-management-only / switch SIM on threshold). Free basic device management on the InHand Device Manager cloud; advanced SD-WAN-style orchestration features are available through a paid Connector license.

View the IR624 product page →   IR624 user manual (PDF link in the manual portal)

The IR624 is the right SD-WAN edge when the branch site is not a clean indoor office. Wellhead, water lift station, factory floor, rooftop cabinet, vehicle depot, parking structure, remote construction office: any site that hits temperature extremes, vibration, dust, or surge on the Ethernet drop. The 1.5 kV Ethernet isolation protects the router from induced surge on long outdoor cable runs, and the IP30 metal housing keeps the dust out. Three upstream link types mean the 5G cellular link, the wireline broadband (if it exists), and a Wi-Fi STA uplink from an existing on-site AP can all sit on the same router and be steered by the SD-WAN policy.

For a 5G SD-WAN overlay that needs a 5G-aware underlay, the IR624 covers the underlay side: dual-SIM, signal telemetry, IPSec/WireGuard/L2TP, policy routing, and link detection. The overlay (Cisco SD-WAN, Fortinet Secure SD-WAN, Peplink SpeedFusion, Versa, Aruba EdgeConnect) runs above it on the same tunnels. For deployments where the SD-WAN controller and policy live in InHand Device Manager itself, the IR624 exposes the same telemetry natively.

FWA12: 5G SD-WAN edge for indoor retail/QSR/clinic branches

InHand FWA12 - 5G FWA CPE for SD-WAN branch

5G NR sub-6 with peak DL 7.01 Gbps, Wi-Fi 7 (802.11be) at 5000 Mbps, 2 x 2.5 GbE, dual Nano-SIM plus eSIM, IPSec + L2TP VPN, InCloud Manager (AI) cloud, zero-touch provisioning. 12V 3A DC, ~24 W consumption. IP20 indoor housing, -10 to +50°C operating, -40 to +85°C storage, 5-95% non-condensing humidity, IEC 60068-2-27 shock / IEC 60068-2-6 vibration. FCC, IC, PTCRB, Verizon, T-Mobile, AT&T certified. US 5G band coverage: n2/n5/n66/n77 (Verizon), n25/n41/n71/n77 (T-Mobile), n5/n77/n260 (AT&T).

View the FWA12 product page →   FWA12 review article on inhandgo.com

The FWA12 is the right SD-WAN edge when the branch is an indoor retail store, QSR, bank branch, or healthcare clinic. Peak DL 7.01 Gbps on sub-6 is the headline number (and it is real on a well-provisioned midband cell), but the more interesting point for SD-WAN is the 2 x 2.5 GbE ports: the FWA12 can sit on the 5G uplink on one WAN and on a wireline broadband (cable, DSL, fibre) on the other, with the SD-WAN overlay steering across both. The Wi-Fi 7 radio at 5000 Mbps serves the in-store Wi-Fi without needing a separate access point.

Zero-touch provisioning on the InCloud Manager is the operational win for a 200-site roll-out: the FWA12 ships to the site, the store IT plugs in power and the 5G antenna, and the device phones home, pulls its config, and joins the SD-WAN overlay. The Carrier Support certifications on all three major US MNOs mean the same hardware SKU works across the entire US footprint.

Realistic limits of 5G as a primary SD-WAN link

5G is a credible primary SD-WAN link in 2026, but it is not a free lunch. The limits below need to be written into the SD-WAN policy, not discovered in the first three months of production.

Coverage is location-dependent

'5G available' on a coverage map and '5G performing at 200 Mbps inside your building' are not the same thing. Site surveys matter. Midband 5G penetrates building walls less well than low-band 5G, and modern energy-efficient construction (metallised glass, foil-backed insulation, steel-frame) absorbs cellular signal aggressively. The fix is external antennas on the rooftop or the outside wall, and a low-loss coax run into the router - not a sticker antenna on the back of the FWA12.

Upload asymmetry

5G download is the headline number. 5G upload typically lags download by 2-4x. For SD-WAN branches with heavy camera upload (CCTV, drive-thru analytics, remote video review), large file sync, or design file transfer, upload asymmetry is the design constraint. 5G-Advanced features such as uplink transmit switching and L4S are improving upload symmetry, but in 2026 the asymmetry is still the rule and the SD-WAN policy must plan for it (e.g., pin camera upload to a wireline broadband backup, not to 5G).

Bill shock on a backup SIM that becomes primary

If the 5G link is the primary underlay and the broadband fails, the SD-WAN overlay fails over to 5G. If the SD-WAN policy is loose, 5G becomes the primary link for days while the broadband gets repaired, and the data cap blows. Mark 5G as metered by default, allow per-application exceptions, enforce per-link monthly caps with a soft cap (throttle) before the hard cap (block everything except critical apps). The IR624 SIM traffic policy exposes notification, cloud-management-only, and switch-SIM actions that close off this failure mode.

Brownout detection is hard

The link is up. The interface shows full bars. The app is unusable. Cellular brownout is the most common cause of 'the SD-WAN is not working' tickets, and the fix is a health-check policy that scores loss, jitter, and latency, not just interface state. BFD plus a per-application policy is the standard answer.

MPLS replacement economics

5G FWA at typical enterprise pricing is a fraction of the recurring cost of an MPLS circuit of equivalent bandwidth, and 5G provisioning is days vs months. For cloud-first branches (SaaS-heavy traffic), 5G as the primary SD-WAN link with broadband as backup is now the default design pattern, especially in retail, QSR, healthcare clinics, and pop-up industrial sites.

MPLS still earns its keep in a few specific places: ultra-low-latency private backbones (trading floors, certain medical imaging systems, government networks), sites with hard regulatory data sovereignty requirements, and sites where a single carrier SLA with financial penalties is a contractual requirement. For everything else, the 5G-first SD-WAN branch is the economic winner on capex, opex, and time-to-service.

Dimension MPLS branch 5G-first SD-WAN branch
Provisioning time 30-90 days (often longer) Days, sometimes hours
Recurring cost (per Mbps) Highest (private circuit) Fraction of MPLS (shared midband)
Bandwidth ceiling Set by circuit speed Up to 7 Gbps peak (5G sub-6 + carrier aggregation)
Latency Single-digit ms on the carrier backbone Single-digit to low-teens ms on midband
Site survey requirement None (wireline) Required (RF plan, external antenna if needed)
Carrier SLA Strong (financial penalties) Moderate; varies by MNO and enterprise plan
Data sovereignty High (private circuit) Public 5G network; private 5G is a separate build

5G SA network slicing and the next frontier

5G SA (Standalone) introduces URLLC (Ultra-Reliable Low-Latency Communication) and network slicing per 3GPP TS 23.501. A 5G-aware SD-WAN controller can classify traffic (real-time industrial automation, telemedicine, video surveillance) and steer it onto a dedicated 5G slice with guaranteed QoS, instead of treating the 5G link as a single best-effort pipe.

In 2026, slice-aware SD-WAN is early in most markets. The standards are set, several MNOs have commercial 5G SA cores in production, and a small number of industrial sites are running real traffic on a 5G slice. The adoption curve looks similar to the early SD-WAN curve in 2014-2017: working standards, working vendor implementations, limited production deployments, growing fast in industrial automation and private 5G. For most retail, QSR, and clinic branches, slice-aware SD-WAN is on the roadmap, not on the design diagram, but the SD-WAN overlay chosen in 2026 should be able to consume slice hints as the MNO exposes them.

Frequently asked questions

What does 'SD-WAN over 5G' actually mean?

It is a transport-independent SD-WAN overlay that uses 5G NR (with 4G LTE fallback) as one of its underlay links, alongside MPLS, broadband, or a second cellular carrier. The overlay is typically IPsec, WireGuard, GRE, or a vendor-proprietary tunnel; the underlay is the raw 5G/LTE transport. The SD-WAN controller steers traffic across underlays based on health-check metrics and per-application policy, not on a single static primary/backup config.

Can 5G actually replace MPLS as the primary SD-WAN link for a branch?

For most cloud-first branches (retail, QSR, healthcare clinics, pop-up industrial sites), yes. Enterprise 5G FWA commonly delivers 100-300+ Mbps with sub-10 ms latency on midband, and provisioning drops from 30-90 days (MPLS) to days or hours. For ultra-low-latency, private-backbone, or regulated workloads (trading floors, certain medical imaging systems, government networks), MPLS still earns its keep. The decision is use-case-driven, not technology-driven.

What is the difference between load balancing, active-active SD-WAN, and link bonding?

Load balancing distributes new sessions across links per-flow; a single TCP/UDP flow stays on one link. Active-active SD-WAN uses multiple links with app-aware steering and health checks; real-time apps move when loss or jitter rises. Link bonding combines links at the packet level via a tunnel to a bonding endpoint; one flow can use multiple links and packet duplication can mask loss. Bonding needs a compatible endpoint (e.g., Peplink SpeedFusion) and adds tunnel overhead and data usage.

What is BFD and why does it matter for SD-WAN over 5G?

BFD (Bidirectional Forwarding Detection) is defined in RFC 5880/5881/5883 and provides sub-second failure detection on IP paths. A typical config of 100 ms transmit interval and 3x multiplier detects a 5G link failure in roughly 300 ms, compared to 1-10 seconds for ICMP-based probing. BFD is the health-check standard for SD-WAN overlays on cellular links, especially where brownout detection (link up but quality poor) is required.

What hardware does a 5G SD-WAN edge router need?

A 5G SD-WAN edge needs dual-SIM with SIM failover and policy-driven SIM switch; signal-quality telemetry (RSRP, RSRQ, SINR) exposed to the SD-WAN controller; IPsec plus WireGuard and L2TP VPN; policy-based routing; dual-WAN or 3-upstream (WAN + 5G + Wi-Fi STA) capability; 1.5 kV Ethernet isolation for industrial sites; and an industrial temperature rating (typically -20 to +70°C). The InHand IR624 is a reference implementation for harsh-environment branches; the FWA12 is a reference implementation for indoor retail/QSR/clinic branches.

How do you avoid bill shock when 5G becomes the primary link by mistake?

Mark 5G as metered by default, then allow per-application exceptions. Enforce per-link monthly caps with a 'soft cap' action (throttle, block bulk classes, alert) before a 'hard cap' action (block everything except critical apps). The IR624 exposes a SIM traffic policy with three actions: notification only, cloud-management-only, and switch-to-other-SIM. Combine this with an SD-WAN policy that pins bulk traffic to the cheapest link, and the bill-shock failure mode is closed off.

What is the role of 5G SA network slicing in SD-WAN?

5G SA (Standalone) introduces URLLC and network slicing per 3GPP TS 23.501. A 5G-aware SD-WAN controller can classify traffic (e.g., real-time industrial automation, telemedicine) and steer it onto a dedicated 5G slice with guaranteed QoS. In 2026, slice-aware SD-WAN is early in most markets, but the standard is set and adoption is accelerating, particularly for industrial automation and private 5G deployments.

Sources and references

 

 

SD-WAN over 5G: Building Resilient Branch Networks

A 5G link on a branch router is no longer a backup-of-last-resort. In 2026, with midband coverage, 5G-Advanced features, and SD-WAN overlays that can score and steer around wireless jitter, 5G is a credible primary underlay for retail, QSR, healthcare, and pop-up industrial branches. This guide walks through the three link modes, the health-check policies that actually work, the 5G edge router hardware checklist, and the realistic limits you still have to plan around.

Published 2026-06-23 by the InHand Networks Technical Team. 12 min read.

What 'SD-WAN over 5G' means and why 5G is a credible branch underlay in 2026

SD-WAN over 5G is a transport-independent SD-WAN overlay that uses 5G NR (with 4G LTE fallback) as one of its underlay links, alongside MPLS, broadband, or a second cellular carrier. The overlay is typically IPsec, WireGuard, GRE, or a vendor-proprietary tunnel; the underlay is the raw 5G or LTE transport. The SD-WAN controller scores each underlay on live health-check metrics and steers traffic per application, not on a static primary/backup config.

What changed in the last three years is the underlay. Enterprise-grade 5G fixed wireless access (FWA) for business commonly delivers 100 to 300+ Mbps on midband (C-band) coverage, with sub-10 ms latency in well-provisioned cells. Provisioning dropped from 30 to 90 days for an MPLS circuit to days or hours for a 5G SIM and a self-install antenna. In the United States, the three major MNOs (Verizon, T-Mobile, AT&T) all have 5G midband live in the major metro areas, and 5G SA cores are now operating in all three. That is the underlay foundation that turns 'cellular backup' into 'cellular-first'.

Why SD-WAN is still required on top of 5G: a 5G link on its own has more jitter and more variability than fibre. The SD-WAN overlay does not eliminate that variability, but it scores the link on latency, jitter, and packet loss in real time, and it steers voice and Teams off the path the moment the score crosses a policy threshold. 5G is the underlay, SD-WAN is the policy that makes the underlay acceptable for real-time traffic.

For a typical cloud-first branch in 2026 - a retail store, a quick-service restaurant, a bank branch, a healthcare clinic, a pop-up industrial site - the SD-WAN topology is now: 5G as the primary, a wireline broadband circuit (cable, DSL, fibre) as the backup, the SD-WAN overlay managing both. The decision is rarely '5G or MPLS' any more; it is 'which 5G edge router, which SD-WAN overlay, which policy thresholds'.

Once you commit to a 5G SD-WAN branch, the first real question is which link mode the design needs. There are three, and the choice cascades into the firmware feature set, the SD-WAN overlay, and the upstream link configuration of the 5G edge router.

Mode What it does What you actually get on LTE/5G Best fit
Load balancing Distributes new sessions across links (per-flow rules). More total throughput across many users and apps. A single TCP/UDP flow stays on one link. Busy sites with mixed traffic: POS plus guest Wi-Fi, field office uploads, multi-user trailers.
Active-active SD-WAN Uses multiple links with app-aware steering and health checks. Better uptime and app performance. Real-time apps move to the healthier link when loss or jitter rises. Teams, Zoom, VoIP, VDI, and any site where 'degraded' is as bad as 'down'.
Link bonding (SpeedFusion, SD-WAN bonding, etc.) Combines links at the packet level using a tunnel to a bonding endpoint. One flow can use multiple links, and packet duplication can mask loss. Requires a compatible hub, cloud gateway, or concentrator. Live video, critical remote access, high-loss RF environments, moving vehicles.

Most 5G SD-WAN branches land on active-active. Load balancing is what a dual-WAN consumer router does; it does not give you per-flow aggregation and it does not steer real-time traffic off a degraded link. Link bonding is the right tool for a specific set of problems (live uplink from a moving vehicle, a high-loss cell edge where packet duplication pays for itself) but it adds tunnel overhead, raises data usage, and needs a bonding endpoint on the far side.

Common mistake: turning on link bonding because the marketing says it doubles bandwidth. Bonding does not create free bandwidth. If both 5G links sit on the same tower sector, congestion hits both at once. For a typical branch, active-active SD-WAN with well-tuned health checks is the right answer. Reach for bonding only when the failure mode is 'one specific flow cannot tolerate loss'.

Health checks, BFD, and policy-driven failover

Cellular links can look 'up' at the interface level while real traffic is suffering from rising latency, jitter, or packet loss. SD-WAN avoids that trap by continuously scoring each path and moving sessions when the score crosses a policy threshold. The mechanism underneath the score is a health check on each upstream link, and the right protocol for sub-second detection is BFD.

What BFD actually does

BFD (Bidirectional Forwarding Detection) is defined in RFC 5880, with IP-routed single-hop and multihop variants in RFC 5881 and RFC 5883. The router sends BFD control packets at a configured interval (typically 100 ms); if it misses three in a row, the session goes down. With a 100 ms transmit interval and a 3x multiplier, a 5G link failure is detected in roughly 300 ms, vs 1 to 10 seconds for ICMP-based probing. BFD is the standard health-check mechanism for SD-WAN overlays on cellular links, especially where the operator needs brownout detection (the link stays up but app performance has collapsed).

Health-check thresholds that actually work on 5G

The thresholds below come from deployed 5G SD-WAN policies in retail, QSR, and industrial branch rollouts. They are not vendor-specific. They are useful as a starting point and need to be tuned against the actual underlay behaviour at the site.

Traffic class Fail-over trigger Hold-down before failback
Voice and video (Teams, Zoom, SIP/RTP, VDI) Loss > 2-3% for 10-20 s, or jitter > 30-50 ms for 10-20 s. 2-5 minutes.
Transactional apps (POS, EMR, RDP/SSH, site-to-site VPN) Loss > 5% for 20-30 s, or latency > 200-300 ms for 30-60 s. 5-10 minutes.
Bulk traffic (Windows Update, iCloud/OneDrive sync, camera uploads) Pin to the cheapest link; throttle hard when 5G is active; do not fail over on transient loss. N/A (never fail over).

Hysteresis matters as much as the threshold. Without a hold-down timer, the SD-WAN overlay flapps between 5G and broadband every time the 5G link recovers for 30 seconds, and Teams calls drop twice in five minutes. Most 5G SD-WAN policies keep the failback threshold a tier above the failover threshold (e.g., fail over on loss > 2%, fail back on loss < 1% for 5 minutes straight) and rate-limit bulk traffic away from 5G by default.

The 5G edge router hardware checklist

The SD-WAN overlay is only as good as the 5G edge router underneath it. The checklist below is the minimum for a 5G SD-WAN branch in 2026; anything missing is a future truck roll.

1. Dual-SIM with policy-driven SIM switch

Single-SIM 5G is a single point of failure on the carrier side. A 5G SD-WAN edge needs two physical SIM slots, the ability to set priority and force SIM selection, and the ability to switch SIMs on a signal threshold or a monthly data cap. The InHand IR624 has a drawer-style dual-NANO SIM slot plus an optional 1.8 V/3 V eSIM, and exposes a SIM traffic policy with three actions on a threshold: notification only, cloud-management-only, and switch to the other SIM.

2. Signal-quality telemetry exposed to the controller

SD-WAN reacts to loss and latency, but RF quality drives both. The edge router must expose RSRP, RSRQ, SINR, and band information to the SD-WAN controller, so that brownout detection is grounded in real RF data, not just IP-layer probes. The IR624 exposes these on its local web UI and on the InHand Device Manager cloud dashboard.

3. IPsec plus WireGuard and L2TP VPN

The SD-WAN overlay tunnel is usually IPsec, WireGuard, or both. The edge router must run both natively (not via a slow software add-on) and the VPN throughput must be published in the datasheet. WireGuard is line-rate on most modern router CPUs; IPsec with AES-256 typically sits at 200-400 Mbps. The IR624 supports IPSec, L2TP, PPTP, OpenVPN, GRE, and WireGuard in firmware.

4. Three upstream link types with link backup and load balancing

A pure 5G-only edge is a fragile design. A 5G SD-WAN edge should support at least three upstream types: WAN Ethernet (for the wireline broadband or fibre circuit), 5G/4G cellular, and Wi-Fi STA (to join an existing Wi-Fi as a third underlay). Link backup (active/passive) and load balancing (active/active across the three) should both be configurable. The IR624 supports exactly this set, with link detection on latency, jitter, packet loss, and signal strength.

5. Industrial hardening for the site class

A retail branch in a climate-controlled mall needs -10 to +50°C and IP20 indoor housing (the FWA12 fits this). A rooftop industrial cabinet, a remote lift station, a wellhead, a vehicle, or a roadside cabinet needs -20 to +70°C, IP30 or better, EMC level 3, 1.5 kV Ethernet isolation, fan-less metal housing, and DIN-rail or wall mounting. The IR624 is the reference point for that site class.

IR624: 5G SD-WAN edge for harsh industrial branches

InHand IR624 - 5G industrial router for SD-WAN edge

5G NR sub-6 with downlink up to 2 Gbps and 4G LTE fallback. 880 MHz CPU, 256 MB RAM, 128 MB Flash. 4 x 10/100/1000 Mbps Ethernet with 1.5 kV network isolation, DC 9-48 V input, 1 x RS-232 + 1 x RS-485, dual-NANO SIM drawer with optional eSIM, 4 x SMA for 5G (2 x for 4G) plus 2 x RP-SMA for Wi-Fi. IPSec/L2TP/WireGuard/OpenVPN/GRE/PPTP VPN. IP30 metal housing, fan-less, -20 to +70°C operating, EMC level 3, DIN-rail or wall mount. FCC, IC, PTCRB, Verizon, T-Mobile, AT&T carrier certified.

Three upstream link types (WAN, cellular, Wi-Fi STA) with link backup and load balancing modes, and a SIM traffic policy (notification / cloud-management-only / switch SIM on threshold). Free basic device management on the InHand Device Manager cloud; advanced SD-WAN-style orchestration features are available through a paid Connector license.

View the IR624 product page →   IR624 user manual (PDF link in the manual portal)

The IR624 is the right SD-WAN edge when the branch site is not a clean indoor office. Wellhead, water lift station, factory floor, rooftop cabinet, vehicle depot, parking structure, remote construction office: any site that hits temperature extremes, vibration, dust, or surge on the Ethernet drop. The 1.5 kV Ethernet isolation protects the router from induced surge on long outdoor cable runs, and the IP30 metal housing keeps the dust out. Three upstream link types mean the 5G cellular link, the wireline broadband (if it exists), and a Wi-Fi STA uplink from an existing on-site AP can all sit on the same router and be steered by the SD-WAN policy.

For a 5G SD-WAN overlay that needs a 5G-aware underlay, the IR624 covers the underlay side: dual-SIM, signal telemetry, IPSec/WireGuard/L2TP, policy routing, and link detection. The overlay (Cisco SD-WAN, Fortinet Secure SD-WAN, Peplink SpeedFusion, Versa, Aruba EdgeConnect) runs above it on the same tunnels. For deployments where the SD-WAN controller and policy live in InHand Device Manager itself, the IR624 exposes the same telemetry natively.

FWA12: 5G SD-WAN edge for indoor retail/QSR/clinic branches

InHand FWA12 - 5G FWA CPE for SD-WAN branch

5G NR sub-6 with peak DL 7.01 Gbps, Wi-Fi 7 (802.11be) at 5000 Mbps, 2 x 2.5 GbE, dual Nano-SIM plus eSIM, IPSec + L2TP VPN, InCloud Manager (AI) cloud, zero-touch provisioning. 12V 3A DC, ~24 W consumption. IP20 indoor housing, -10 to +50°C operating, -40 to +85°C storage, 5-95% non-condensing humidity, IEC 60068-2-27 shock / IEC 60068-2-6 vibration. FCC, IC, PTCRB, Verizon, T-Mobile, AT&T certified. US 5G band coverage: n2/n5/n66/n77 (Verizon), n25/n41/n71/n77 (T-Mobile), n5/n77/n260 (AT&T).

View the FWA12 product page →   FWA12 review article on inhandgo.com

The FWA12 is the right SD-WAN edge when the branch is an indoor retail store, QSR, bank branch, or healthcare clinic. Peak DL 7.01 Gbps on sub-6 is the headline number (and it is real on a well-provisioned midband cell), but the more interesting point for SD-WAN is the 2 x 2.5 GbE ports: the FWA12 can sit on the 5G uplink on one WAN and on a wireline broadband (cable, DSL, fibre) on the other, with the SD-WAN overlay steering across both. The Wi-Fi 7 radio at 5000 Mbps serves the in-store Wi-Fi without needing a separate access point.

Zero-touch provisioning on the InCloud Manager is the operational win for a 200-site roll-out: the FWA12 ships to the site, the store IT plugs in power and the 5G antenna, and the device phones home, pulls its config, and joins the SD-WAN overlay. The Carrier Support certifications on all three major US MNOs mean the same hardware SKU works across the entire US footprint.

Realistic limits of 5G as a primary SD-WAN link

5G is a credible primary SD-WAN link in 2026, but it is not a free lunch. The limits below need to be written into the SD-WAN policy, not discovered in the first three months of production.

Coverage is location-dependent

'5G available' on a coverage map and '5G performing at 200 Mbps inside your building' are not the same thing. Site surveys matter. Midband 5G penetrates building walls less well than low-band 5G, and modern energy-efficient construction (metallised glass, foil-backed insulation, steel-frame) absorbs cellular signal aggressively. The fix is external antennas on the rooftop or the outside wall, and a low-loss coax run into the router - not a sticker antenna on the back of the FWA12.

Upload asymmetry

5G download is the headline number. 5G upload typically lags download by 2-4x. For SD-WAN branches with heavy camera upload (CCTV, drive-thru analytics, remote video review), large file sync, or design file transfer, upload asymmetry is the design constraint. 5G-Advanced features such as uplink transmit switching and L4S are improving upload symmetry, but in 2026 the asymmetry is still the rule and the SD-WAN policy must plan for it (e.g., pin camera upload to a wireline broadband backup, not to 5G).

Bill shock on a backup SIM that becomes primary

If the 5G link is the primary underlay and the broadband fails, the SD-WAN overlay fails over to 5G. If the SD-WAN policy is loose, 5G becomes the primary link for days while the broadband gets repaired, and the data cap blows. Mark 5G as metered by default, allow per-application exceptions, enforce per-link monthly caps with a soft cap (throttle) before the hard cap (block everything except critical apps). The IR624 SIM traffic policy exposes notification, cloud-management-only, and switch-SIM actions that close off this failure mode.

Brownout detection is hard

The link is up. The interface shows full bars. The app is unusable. Cellular brownout is the most common cause of 'the SD-WAN is not working' tickets, and the fix is a health-check policy that scores loss, jitter, and latency, not just interface state. BFD plus a per-application policy is the standard answer.

MPLS replacement economics

5G FWA at typical enterprise pricing is a fraction of the recurring cost of an MPLS circuit of equivalent bandwidth, and 5G provisioning is days vs months. For cloud-first branches (SaaS-heavy traffic), 5G as the primary SD-WAN link with broadband as backup is now the default design pattern, especially in retail, QSR, healthcare clinics, and pop-up industrial sites.

MPLS still earns its keep in a few specific places: ultra-low-latency private backbones (trading floors, certain medical imaging systems, government networks), sites with hard regulatory data sovereignty requirements, and sites where a single carrier SLA with financial penalties is a contractual requirement. For everything else, the 5G-first SD-WAN branch is the economic winner on capex, opex, and time-to-service.

Dimension MPLS branch 5G-first SD-WAN branch
Provisioning time 30-90 days (often longer) Days, sometimes hours
Recurring cost (per Mbps) Highest (private circuit) Fraction of MPLS (shared midband)
Bandwidth ceiling Set by circuit speed Up to 7 Gbps peak (5G sub-6 + carrier aggregation)
Latency Single-digit ms on the carrier backbone Single-digit to low-teens ms on midband
Site survey requirement None (wireline) Required (RF plan, external antenna if needed)
Carrier SLA Strong (financial penalties) Moderate; varies by MNO and enterprise plan
Data sovereignty High (private circuit) Public 5G network; private 5G is a separate build

5G SA network slicing and the next frontier

5G SA (Standalone) introduces URLLC (Ultra-Reliable Low-Latency Communication) and network slicing per 3GPP TS 23.501. A 5G-aware SD-WAN controller can classify traffic (real-time industrial automation, telemedicine, video surveillance) and steer it onto a dedicated 5G slice with guaranteed QoS, instead of treating the 5G link as a single best-effort pipe.

In 2026, slice-aware SD-WAN is early in most markets. The standards are set, several MNOs have commercial 5G SA cores in production, and a small number of industrial sites are running real traffic on a 5G slice. The adoption curve looks similar to the early SD-WAN curve in 2014-2017: working standards, working vendor implementations, limited production deployments, growing fast in industrial automation and private 5G. For most retail, QSR, and clinic branches, slice-aware SD-WAN is on the roadmap, not on the design diagram, but the SD-WAN overlay chosen in 2026 should be able to consume slice hints as the MNO exposes them.

Frequently asked questions

What does 'SD-WAN over 5G' actually mean?

It is a transport-independent SD-WAN overlay that uses 5G NR (with 4G LTE fallback) as one of its underlay links, alongside MPLS, broadband, or a second cellular carrier. The overlay is typically IPsec, WireGuard, GRE, or a vendor-proprietary tunnel; the underlay is the raw 5G/LTE transport. The SD-WAN controller steers traffic across underlays based on health-check metrics and per-application policy, not on a single static primary/backup config.

Can 5G actually replace MPLS as the primary SD-WAN link for a branch?

For most cloud-first branches (retail, QSR, healthcare clinics, pop-up industrial sites), yes. Enterprise 5G FWA commonly delivers 100-300+ Mbps with sub-10 ms latency on midband, and provisioning drops from 30-90 days (MPLS) to days or hours. For ultra-low-latency, private-backbone, or regulated workloads (trading floors, certain medical imaging systems, government networks), MPLS still earns its keep. The decision is use-case-driven, not technology-driven.

What is the difference between load balancing, active-active SD-WAN, and link bonding?

Load balancing distributes new sessions across links per-flow; a single TCP/UDP flow stays on one link. Active-active SD-WAN uses multiple links with app-aware steering and health checks; real-time apps move when loss or jitter rises. Link bonding combines links at the packet level via a tunnel to a bonding endpoint; one flow can use multiple links and packet duplication can mask loss. Bonding needs a compatible endpoint (e.g., Peplink SpeedFusion) and adds tunnel overhead and data usage.

What is BFD and why does it matter for SD-WAN over 5G?

BFD (Bidirectional Forwarding Detection) is defined in RFC 5880/5881/5883 and provides sub-second failure detection on IP paths. A typical config of 100 ms transmit interval and 3x multiplier detects a 5G link failure in roughly 300 ms, compared to 1-10 seconds for ICMP-based probing. BFD is the health-check standard for SD-WAN overlays on cellular links, especially where brownout detection (link up but quality poor) is required.

What hardware does a 5G SD-WAN edge router need?

A 5G SD-WAN edge needs dual-SIM with SIM failover and policy-driven SIM switch; signal-quality telemetry (RSRP, RSRQ, SINR) exposed to the SD-WAN controller; IPsec plus WireGuard and L2TP VPN; policy-based routing; dual-WAN or 3-upstream (WAN + 5G + Wi-Fi STA) capability; 1.5 kV Ethernet isolation for industrial sites; and an industrial temperature rating (typically -20 to +70°C). The InHand IR624 is a reference implementation for harsh-environment branches; the FWA12 is a reference implementation for indoor retail/QSR/clinic branches.

How do you avoid bill shock when 5G becomes the primary link by mistake?

Mark 5G as metered by default, then allow per-application exceptions. Enforce per-link monthly caps with a 'soft cap' action (throttle, block bulk classes, alert) before a 'hard cap' action (block everything except critical apps). The IR624 exposes a SIM traffic policy with three actions: notification only, cloud-management-only, and switch-to-other-SIM. Combine this with an SD-WAN policy that pins bulk traffic to the cheapest link, and the bill-shock failure mode is closed off.

What is the role of 5G SA network slicing in SD-WAN?

5G SA (Standalone) introduces URLLC and network slicing per 3GPP TS 23.501. A 5G-aware SD-WAN controller can classify traffic (e.g., real-time industrial automation, telemedicine) and steer it onto a dedicated 5G slice with guaranteed QoS. In 2026, slice-aware SD-WAN is early in most markets, but the standard is set and adoption is accelerating, particularly for industrial automation and private 5G deployments.

Sources and references