I've been evaluating NordLayer's "Site-to-Site" feature for a potential client looking to simplify some basic connectivity between a handful of small offices and their AWS VPC. Let's be clear from the start: this is **not** an SD-WAN. If you're coming into this thinking it's a competitor to solutions from Aruba, Versa, or even a cloud-native like Cisco Meraki, you will be deeply disappointed. It's a marketing label on what is essentially a managed VPN mesh.
The core offering is a layer 3 IPsec mesh between your "sites," where a site can be a physical office with a NordLayer connector app running on a gateway machine, a cloud VPC, or even individual devices. It's a VPN. A managed, somewhat user-friendly VPN, but a VPN nonetheless.
Here’s a breakdown of what you're actually getting and where it falls critically short of a true SD-WAN:
* **No Dynamic Path Control:** A real SD-WAN continuously monitors multiple WAN links (like MPLS, broadband, 5G) for latency, jitter, packet loss, and intelligently steers traffic per-application over the best path. NordLayer Site-to-Site establishes a single tunnel over whatever internet connection the host has. If that link degrades, your traffic degrades. There's no failover to a secondary link, no splicing of packets across connections.
* **Zero Application-Aware Routing:** You cannot define policies like "send all Salesforce traffic direct-to-internet but route database traffic over the tunnel to the datacenter." It's a full-tunnel or split-tunnel setup based on IP ranges, not L7 application identification.
* **Limited Orchestration & Visibility:** The management console is for adding nodes and seeing connectivity status (up/down). You get no deep insights into performance metrics across the tunnels, no application performance monitoring, no quality of experience scoring. It's basic operational telemetry.
A typical configuration for, say, linking a couple of on-prem segments to AWS might look like this in their dashboard, but remember, this is just defining VPN endpoints:
```yaml
# This is illustrative of the *concepts*, not actual NordLayer config
Sites:
- Name: "Office-NY"
Connector: "Installed on local Linux box"
Private CIDR: "10.0.1.0/24"
- Name: "Office-LA"
Connector: "Installed on local Linux box"
Private CIDR: "10.0.2.0/24"
- Name: "AWS-Prod-VPC"
Connector: "Via NordLayer's Gateway (assigned IP)"
Private CIDR: "172.16.0.0/16"
# Result: A full mesh where 10.0.1.0/24, 10.0.2.0/24, and 172.16.0.0/16 can all route to each other.
```
**So, who is this actually for?** It's for small businesses or teams that need a dead-simple way to connect a few fixed locations with static IP ranges without managing their own OpenVPN or WireGuard infrastructure. It's "Site-to-Site" in the most literal sense: it connects point A to point B over the internet.
If your requirements are "I need a secure, managed tunnel between a few clouds and offices," and you prioritize simplicity over advanced features, it's worth a trial. If you need any of the intelligence, redundancy, or performance optimization that defines SD-WAN, you need to look elsewhere and be prepared for a significant increase in complexity and cost.
Has anyone else pushed this service beyond basic connectivity and hit walls? I'm particularly interested in any attempts to integrate it into a Terraform workflow or if the performance under packet loss is as bad as I suspect.
Been there, migrated that
We're a 25-person SaaS shop in the education tech space, and I recently led a project to replace our legacy Cisco AnyConnect setup for connecting a few remote offices and devs to our Azure environment. I tested NordLayer's Site-to-Site and ultimately went with a different solution, but I learned exactly where it fits.
My breakdown for a buyer comparing it to SD-WAN:
**Target User & Budget:** This is squarely for SMBs or small project teams where IT is not a dedicated role. List pricing is around $9-12 per "seat" per month, billed annually, where each site or gateway counts as a seat. For 5-10 sites, you're looking at roughly $540-$1200 per year, which is a fraction of even a basic Meraki SD-WAN setup.
**Deployment & Management Effort:** You can get a simple mesh of three sites (like two offices and a cloud VPC) running in an afternoon. The Windows connector app runs on any always-on machine, and the cloud gateways are configured through a click-through portal. It's the opposite of dealing with traditional VPN concentrators or CLI. However, migrating out later is a manual process - you're rebuilding tunnels elsewhere.
**Honest Technical Limitation:** As the OP says, it's a single encrypted tunnel over the existing internet path. In my tests, when the underlying ISP link at one office had a latency spike, all traffic in that tunnel suffered. There's no application-aware routing or failover to a secondary WAN link. We also saw a hard throughput limit we couldn't adjust; we maxed out at a sustained ~85 Mbps per tunnel in our performance tests.
**Where It Clearly Wins:** It eliminates VPN configuration complexity. Setting up a traditional site-to-site VPN, especially with a cloud provider, often requires matching IKE versions, pre-shared keys, and subnet definitions. NordLayer abstracts all that. For a non-networking person who needs basic, encrypted connectivity between a few fixed points, it's a legitimate time-saver.
My pick: I'd only recommend NordLayer Site-to-Site for a specific case: a small business with sub-10 locations, a single internet circuit per site, and no in-house network expertise, that needs a simple encrypted mesh. If your client has any need for application prioritization (like VoIP), dual WAN links, or expects to scale beyond 15 sites, you should look at a real SD-WAN. Tell us your client's approx site count and if they have more than one internet connection per office - that makes the call easy.
Your pricing math is on point. The cost delta versus true SD-WAN is the main driver here.
You mentioned migration being manual. I've seen that trap. You're not just rebuilding tunnels, you're redefining all your network policies and access rules from scratch. That hidden labor cost can blow a project timeline.
What solution did you land on instead?
Prove it with a benchmark.
You're spot on about the dynamic path control. That's the killer feature you're missing.
I've seen teams get burned expecting magic where there isn't any. If your office's single broadband link goes down, that NordLayer tunnel is just... gone. No failover to a 4G/5G dongle, no rerouting, no application-aware steering.
It's fine for basic, always-on connectivity over reliable links, but the moment you need any resilience or performance tuning for specific apps (like VoIP or a database sync), you're back to square one. You'd need to build that logic yourself outside their mesh.
Always A/B test.
Totally agree on it being a managed VPN mesh, not SD-WAN. Your point about > No Dynamic Path Control< is what I've been trying to wrap my head around.
For someone new to networking, could you give a real example of what that dynamic steering would look like? Like, would a true SD-WAN automatically split traffic, sending Zoom over a 5G backup and database sync over the main fiber if it detects a problem? I'm trying to visualize the gap.