[Q] Moving from MVPM/ MPLS network to public ethernet - SDWAN or IPSEC?

I've got 6 offices.

One of them contains two racks of equipment at one location. This would be our "data center" (big word for such a small closet, granted the server room is like 200sq ft, so I guess that's more than most small businesses).

​

Summary of what we have:

In our datacenter we have a L3 switch and two L2 switches for our core.

We have an Untangle UTM for end default routes. All the edge networks for the other sites point to our L3 switch currently.

Each site has a L2 switch, no routing capabilities. Internet is piped out from one location: traditional hub and spoke setup.

We utilize Citrix XenApp for most of our applications.!<

Reason for change:

Managed services are extremely expensive for what they are providing. We can improve our bandwidth by 10x and reduce re-occurring costs by over 50%. Up time matters, bandwidth matters. We could potentially improve our up time and reduce cost by having a fail over route for when the primary network goes down. We are with Century Link (TW Telecom customer originally) and we seem to experience and outage that costs of a half day of production in on or all offices about three times a year).

We want to move from MPLS/ MVPN to each office having a fiber connection and a gateway. I am wondering if it will be cost effective to utilize SD-WAN, or if I should just skip it and look into Cisco ASAs and a UTM or just keep using Untangle at each branch site.

I would like to be able to have some sort of dynamic fail over with 4G LTE or a cable connection for when backhoe bob strikes - but I am not sure how to plan for a fail over using IPSec tunnels in regards to hardware. You can't have both tunnels active, you would have to turn them on after the primary tunnel break, and 4G LTE would give us a dynamic IP address which complicates the issue - especially if our core site goes offline for whatever reason.

Any suggestions here? I'm skeptical to use Untangle boxes at each site, but It would be a cheaper solution that also provides a UTM. If the one in the core site went down - I could roll another box up in 30 minutes or so with a spare server we have. If a branch goes down it's a 5 hour drive. I have had great success with whitebox Untangle builds over the last three years at other un-related offices.