What is a Region?

A region is a Concerto and Director construct that groups sites – along with the hubs, Director nodes, or Controller nodes that serve them – to scale large SD-WAN networks, enforce role-based access on a region-by-region basis, and shape hub-and-spoke topologies with per-region hub priorities; a Concerto region can also carry its own root domain for SASE gateway FQDN generation.

Key takeaways

• Regions group sites, hubs, and Director nodes for large-scale networks.
• Roles can be scoped per region, limiting what an admin can see.
• The same hub can serve several regions, each with its own priority.
• SHHS (regional-mesh) topology routes inter-region traffic through hubs.
• A region can carry its own root domain for SASE gateway FQDNs.

On this page: Why it matters · How it works · Types · Regions & Versa · FAQ

Why are regions important?

Large SD-WAN and SASE deployments quickly outgrow a single flat site list. Enterprises and service providers with hundreds or thousands of sites need to segment the network for scalability, delegate administration, and shape traffic flow. Regions are Versa’s answer: a topology and access-control boundary that lets an operator assign hubs, Director nodes, and permissions per region rather than managing every site individually.

The access-control payoff is direct. Roles can be scoped to specific regions, so a regional administrator sees and manages only the sites, appliances, and Director nodes inside their assigned regions – nothing else. That containment matters for multi-country or multi-business-unit deployments sharing one Concerto or Director instance.

Regions also shape traffic engineering: the same hub can serve multiple regions at different priorities, and inter-region traffic can be forced through regional hubs, letting designers build topologies too large to manage as one undifferentiated site pool.

What is a region?

A region is a topology object created in Concerto or Director that groups sites with the infrastructure serving them. In Concerto, a region is assigned one or more hubs – each with a region-specific priority – and one or more Director nodes; a new site can only select Director nodes serving its region. A hub can belong to several regions, but each spoke site belongs to exactly one.

Region IDs identify each region numerically – 0 through 64000 in Concerto – and every deployment starts with an automatically created Default region that existing sites are assigned to on upgrade. Regions beyond that baseline are optional, created purely for role-based access even where they serve no networking purpose.

In Director, a matching concept groups hubs, spokes, and Controller nodes for spoke-hub-hub-spoke (SHHS) topologies, where devices tag advertised routes with a region-specific BGP community string so spokes accept only routes carrying their own region’s tag.

Types of regions

Versa documentation describes regions in two related but distinct contexts, plus a baseline every deployment starts with.

Concerto regions are the management and access-control construct: a named group of sites with assigned hubs, Director nodes, and role-based permissions, optionally carrying its own root domain that Concerto uses when generating SASE gateway FQDNs for a tenant and its child tenants.

Director SHHS regions exist for traffic engineering in spoke-hub-hub-spoke topologies: a region groups hubs, spokes, and Controller nodes, and can use dedicated hub-controller nodes (HCNs) that combine hub and Controller functions to serve spokes locally instead of backhauling every session to a top-level Controller.

The Default (Global) region is the baseline every install starts with – Region ID 1 in single-region deployments – and is what existing sites are assigned to automatically on upgrade. Deployments that never need multi-region segmentation can run entirely inside it.

Regions & Versa

Regions run through both halves of the VersaONE platform. In Concerto, the Deploy > Regions workspace is where operators create regions, assign hubs and Director nodes, add sites, and – from Release 13.1.1 – set Read, Update, Delete, and Publish permissions per role per region; see Configure Regions for the full workflow. Release 11.3.1 added per-region root domains, so SASE gateway FQDNs can reflect a country-specific domain instead of the tenant’s default.

In Director, regions surface in workflow templates and spoke groups as a Region field, foundational to spoke-hub-hub-spoke topologies – the Consolidated SD-WAN Design Guide covers this as the regional-mesh topology, recommended for dispersed sites where inter-region traffic should transit regional hubs rather than mesh directly.

Frequently asked questions

What is the difference between a Concerto region and a Director region?

A Concerto region is a management and access-control grouping – sites, hubs, Director nodes, and role permissions. A Director region serves spoke-hub-hub-spoke topologies, tagging routes with a region-specific BGP community so scoping happens at the routing layer, not just administratively.

Can a hub belong to more than one region?

Yes. A hub can be assigned to multiple regions, and Concerto lets an operator set a different priority for that hub in each region. Spoke devices work the other way – each spoke belongs to exactly one region at a time.

What is the Default region?

The Default region is created automatically when Concerto or Director is first installed. Existing sites are assigned to it automatically during upgrades that introduce regions, and deployments that never need multi-region segmentation can leave every site there without creating more.

How do regions affect role-based access control?

Regions let administrators scope roles to specific geographies or business units. A role can be granted Read, Update, Delete, or Publish permissions per region (Release 13.1.1 and later), so an administrator only manages the sites and appliances inside their assigned regions.

What is a hub-controller node, and how does it relate to regions?

A hub-controller node (HCN) combines hub and Controller functions to serve the spokes in its own region locally, rather than backhauling every session to a top-level Controller. HCNs establish tunnels to top-level Controllers; spokes tunnel only to the local HCN.

More on regions

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about regions, these are worth looking at next.