A Controller – the Versa Controller – is a VOS device that supplies the control-plane function of an SD-WAN overlay: it terminates IPsec tunnels and MP-BGP sessions from branch devices, distributes routing between them, and, in SD-LAN deployments, manages the switches those branches connect. Controllers are typically deployed in redundant active-active pairs.
Key takeaways
- A Controller supplies the control-plane function of an SD-WAN overlay.
- It terminates IPsec tunnels and MP-BGP sessions from branch devices.
- Controllers typically deploy as redundant, active-active peer pairs.
- One of three DCA Complex components, alongside Director and Analytics.
- A staging Controller authenticates new devices during zero-touch provisioning.
On this page: Why it mattersHow it worksController deployment modelsController & the VersaONE platformFAQ
Why are Controllers important?
An SD-WAN overlay needs somewhere for its control plane to live, separate from the data plane carrying application traffic. The Controller is that place: without it, branch VOS devices would have no way to discover each other, exchange routes, or establish the secure tunnels an overlay depends on. Every branch’s IPsec and MP-BGP sessions terminate at a Controller, which is what turns a set of individually-configured devices into one coherent, routed fabric.
The Controller is also usually the first piece of headend infrastructure a new device ever talks to. During zero-touch provisioning, a booting device is redirected to a staging Controller node, which authenticates it and hands it enough configuration to come online – before Director’s full production template is ever applied. Losing Controller capacity doesn’t just degrade routing; it can block new branches from onboarding at all, which is why redundancy at this layer is treated as a baseline requirement, not an option.
What is a Controller?
A Controller node runs on either a bare-metal server or a virtual machine. Once deployed, it terminates IPsec tunnels and MP-BGP sessions from branch VOS devices, exchanging the routing information that lets branches reach each other, the headend, and shared resources. A dedicated control network interface connects the Controller to the Director node, carrying the orchestration traffic that lets Director configure devices through the Controller and monitor them.
In SD-LAN deployments, a branch’s WAN edge devices connect its access and core switches to a management Controller node, which Director then uses to provision those switches via zero-touch provisioning – so the Controller’s role extends beyond WAN routing into LAN switch management. Multitenant organizations can also configure a Shared Control Plane, letting a suborganization reuse its parent organization’s control VR routing instance and IPsec tunnels to the Controller instead of provisioning its own.
Controller deployment models
Active-active pairs are the standard production model: two peer Controller nodes are configured together, and deploying either one pushes the configuration to both. The pair establishes an IPsec tunnel and an MP-BGP session between themselves, forming a mesh of route reflectors, so branch connectivity and routing survive the loss of either node.
Staging and post-staging roles are flags on a Controller node rather than separate hardware – the same node, or different nodes, can be designated a staging Controller (which authenticates and activates new devices during zero-touch provisioning) and a post-staging Controller (which the device relies on once its full production configuration is in place). Platform choice – bare-metal server versus virtual machine – is independent of both: either platform supports the same control-plane role and can participate in an active-active pair.
Scale tiers stack on top. A single Controller instance supports up to 256 tenants. Very large or geographically dispersed fleets add Hub-Controller Nodes (HCN) – a hierarchical Controller tier for scaling beyond roughly 2,500 SD-WAN devices per tenant, or for serving isolated regions and mismatched transport domains a flat Controller layer can’t cover efficiently. Multi-tenant service providers can also isolate the underlay itself: disjoint underlay connections give each tenant its own transport VRF on the Controller, closing off VRF leaks without allocating unique IP scopes per customer.
Controller & the VersaONE platform
The Controller is one of three components of the DCA Complex – Director, Controller, and Analytics – the headend that Concerto coordinates in SASE deployments. Director configures devices and pushes templates through the Controller’s control network interface; the Controller keeps the SD-WAN fabric connected and routed; and Controller nodes can host an Application Delivery Controller (ADC) service that fronts log delivery to Analytics, redirecting log connections from a primary Analytics cluster to a secondary one if the primary fails.
Zero-touch provisioning depends on the Controller from the first boot: global ZTP redirects a new device from Versa’s cloud-hosted Versa Staging Server to the customer’s staging Controller node, which authenticates the device over an IPsec IKE connection – using the device’s Versa-signed certificate, stored in its TPM chip – and issues its staging configuration. URL-based ZTP reaches the same staging or post-staging Controller node through a link an on-site installer opens manually, as detailed in Activate VOS Devices and Configure Basic Features.
Frequently asked questions
What’s the difference between the Controller and Versa Director?
Director is the management plane – templates, configuration, monitoring. The Controller is the SD-WAN control plane: branch devices establish IPsec tunnels and MP-BGP sessions to it and exchange routing through it. Director tells devices what to be; the Controller keeps the SD-WAN fabric connected and routed.
Why are Controllers deployed in pairs?
For redundancy. Two peer Controller nodes running active-active exchange an IPsec tunnel and MP-BGP session between themselves, forming a mesh of route reflectors, and Director pushes configuration to both simultaneously – so a single node failure doesn’t take down the SD-WAN control plane.
What’s the difference between a staging Controller and a post-staging Controller?
They’re roles a Controller node is flagged with, not necessarily different hardware. A staging Controller authenticates a new device and issues its minimal staging configuration during zero-touch provisioning; a post-staging Controller is the one that serves the device’s full production configuration afterward.
Does the Controller manage switches, not just SD-WAN routing?
Yes, in SD-LAN deployments. WAN edge devices connect access and core switches to a management Controller node, which the Director node then uses to provision those switches through zero-touch provisioning – alongside the Controller’s core SD-WAN control-plane role for the branch itself.
Can a Controller be deployed as a virtual machine?
Yes. A Controller node can run on either a bare-metal server or a virtual machine, and both are common in production. Either platform choice supports the same control-plane role, and pairing two Controllers, on either platform, in active-active mode is how redundancy is normally achieved.
More on the Versa Controller
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages for the headend the Controller belongs to – capabilities, editions, and architecture briefs. | How the SD-WAN service the Controller’s control plane underpins is packaged and delivered, from the vendor. | Versa’s training portal: courses and labs covering Controller deployment and the SD-WAN fabric it anchors. |
Related terms
If you’re reading about the Controller, these are worth looking at next.
| DCA Complex | Active-Active | Versa Staging Server |
|---|---|---|
| The Director, Controller, and Analytics trio that the Controller belongs to, coordinated by Concerto. | The redundancy mode Controllers typically deploy in – both peer nodes active, rather than one standing by idle. | The cloud-hosted node that authenticates a new device and redirects it to its staging Controller node. |