What is a Hub?

A hub is a VOS device in a Versa SD-WAN hub-and-spoke topology that spoke devices at branch sites connect to and route traffic through. Configured with a site ID, transport addresses, and management addresses, a hub can also export application-monitoring metrics to its spokes to inform their path decisions.

Key takeaways

• A hub is the VOS device spoke branches connect to and route through.
• Configured with a site ID, transport addresses, and management addresses.
• Versa supports several hub-and-spoke variants, from spoke-to-hub-only to regional mesh.
• Hubs export application-monitoring metrics that spokes use for path selection.
• SSE hubs extend the same role to interconnect SD-WAN with Versa’s cloud SSE.

On this page: Why it matters · How it works · Types · Hubs & Versa · FAQ

Why are hubs important?

Hubs are what make hub-and-spoke topologies scale. Without a central relay point, every branch reaching every other branch needs a full mesh of overlay tunnels, and SLA monitoring traffic grows with it. Routing spoke traffic through one or more hubs collapses that overhead: spokes only need paths to their hubs, and the network scales to large branch counts without exhausting low-bandwidth WAN links.

Hubs also concentrate control, centralizing security inspection rather than replicating it at every branch, and redundant, prioritized hubs add failover resilience spokes don’t manage themselves. The same role extends beyond SD-WAN: in a SASE deployment, hubs already present in the SD-WAN can interconnect it with Versa’s cloud-hosted Security Service Edge, turning existing infrastructure into the on-ramp for a unified SD-WAN–SSE solution.

What is a hub?

In Versa’s SD-WAN architecture, a hub is a VOS device – a branch, data center, or dedicated site – that spokes connect to and route through, rather than communicating directly with each other. A hub is configured like any other SD-WAN edge device, distinguished by its role: depending on the topology, it may re-advertise spoke routes or keep them isolated.

The hub relationship is built through BGP: route distinguishers, community strings, and import/export policies determine which routes spokes learn and which hub each prefers when more than one is available, priority values favoring one and treating the rest as backup.

Because a hub sits on the data path between spokes, it can also see application performance across those paths and export the metrics it collects to its spokes, which combine them with their own locally collected data for path selection.

Types of hubs

Versa SD-WAN supports several hub-and-spoke variants, distinguished by how spoke routes are handled. In spoke-to-hub only, the hub does not re-advertise spoke routes, so spokes never learn about each other – for spokes needing only shared resources like a data center. In spoke-to-spoke via hub, the hub re-advertises spoke prefixes as next hop, so spokes reach each other only by transiting it. Spoke-to-spoke direct (partial mesh) lets branches in the same spoke group communicate directly while using hubs for other groups. Spoke-hub-hub-spoke (regional mesh) groups hubs and branches by region, routing inter-regional traffic through regional hubs.

A related variant is the hub-controller node (HCN), consolidating Controller and hub functionality onto one device to interconnect isolated SD-WAN islands – regions where restrictions on encrypted traffic prevent a unified control plane. A gateway hub is an existing branch or hub site doubling as the gateway connecting sites over disjointed underlays.

Hubs & Versa

Versa Concerto extends the hub role into SASE with the SD-WAN–SSE hub interconnect architecture: SSE hubs already in the customer’s SD-WAN connect to Versa Cloud Gateways over redundant IPsec or GRE tunnels with EBGP. This lets Versa Secure Private Access route work-from-anywhere users to private applications, and lets Versa Secure Internet Access protect internet-bound traffic, both riding hub connectivity already built for SD-WAN.

Configuration splits across two consoles: BGP peering and site-to-site tunnels on Concerto for the cloud-gateway side, and TVI interfaces, VPN profiles, and redistribution policies on Director for the SSE hub. The Versa SD-WAN Design Guide and Consolidated SD-WAN Design Guide cover the variants these deployments build on.

Frequently asked questions

What is the difference between a hub and a spoke?

A hub is the relay point spokes connect to and route through; a spoke is a branch-site device that connects to at least one hub. Hubs typically re-advertise routes and export monitoring metrics; spokes consume those routes and metrics to reach other sites and applications.

Can a branch site also function as a hub?

Yes. An existing branch, data center, or hub site can double as a gateway or hub for other sites, particularly to connect devices over disjointed underlay networks. The distinction is topological, not physical – any VOS device can play the hub role.

How do spokes choose which hub to use when there is more than one?

Through BGP priority. Hub routes carry community strings and local-preference values that make one hub the active next hop and others backup paths, visible in a spoke’s route table as multiple entries for the same prefix with the preferred hub marked active.

What is a hub-controller node (HCN)?

An HCN consolidates Controller and hub functionality onto one device to interconnect isolated SD-WAN islands – regions where government restrictions on encrypted traffic prevent a shared control plane – while still exchanging routes with the Versa headend Controller over IBGP, keeping the wider network’s routing unified.

How does SSE hub integration extend SD-WAN into SASE?

Existing SD-WAN SSE hubs connect to Versa Cloud Gateways over redundant IPsec or GRE tunnels running EBGP, giving work-from-anywhere users and internet-bound traffic a path into Versa’s cloud-hosted Security Service Edge without building new on-premises infrastructure just to reach the cloud.

More on hub-and-spoke networking

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about hubs, these are worth looking at next.