Versa Secure Private Access (VSPA) is the remote-access component of Versa’s Security Service Edge: a Zero Trust Network Access solution that connects users to private applications – hosted on-premises or in the cloud – by enforcing identity-based, least-privilege access instead of the broad network reachability a traditional VPN grants.
Key takeaways
- VSPA is Versa SSE’s ZTNA component for private application access.
- It replaces network-level VPN access with identity- and context-based policy.
- Registration, connection, and policy enforcement form a three-stage model.
- VSPA supports both a SASE client and clientless connectivity.
- It pairs with Versa Secure Internet Access (VSIA) inside the SSE fabric.
On this page: Why it mattersHow it worksVSPA componentsVSPA & the Versa platformFAQ
Why is VSPA important?
Traditional VPN concentrators grant access at the network level: once connected, a user typically reaches broad segments of the internal network, secured mainly by static access lists that cannot distinguish one user context from another. That model widens the blast radius of a compromised credential or device and makes it hard to enforce least privilege against specific applications.
VSPA addresses this by applying Zero Trust Network Access principles to remote and branch connectivity: policy is evaluated against identity and context, not network location, so a user’s access is scoped to the specific private applications they are authorized for, wherever those applications are hosted. Because VSPA integrates with existing enterprise tools rather than requiring a redesign, organizations can move from broad VPN access to least-privilege, continuously evaluated access without replacing their application environment.
What is VSPA?
VSPA connects users to private applications by enforcing identity-based network access regardless of the user’s location or the application’s hosting environment, applying least-privilege control and continuous trust evaluation rather than a one-time connection check.
Versa describes VSPA’s protection as three stages. Registration authenticates the user at first client use – supporting LDAP, single sign-on, and the Versa Directory of local users, with multifactor authentication via TOTP or email – then downloads the client’s configuration from the SASE portal. Connection determines connectivity behavior from context: fail-close or fail-open handling, best-gateway selection, gateway-to-client policy such as encryption levels, always-on operation, and trusted-network detection to distinguish a public network from a secure corporate location. Policy enforcement then applies corporate policy, ZTNA rules, and SWG-style protections – URL, file, DNS, and IP filtering, antivirus, and intrusion prevention – to the user’s traffic.
VSPA components
VSPA is built from four parts. Cloud gateways – Versa Cloud Gateways (VCGs) – form the SASE fabric and process remote-user traffic through a single-pass architecture. A SASE client extends the fabric to end-user devices across Windows, macOS, iOS, Android, Chromebook, and Linux; VSPA also supports clientless connectivity for cases where installing an agent is not practical. SD-WAN-enabled connectivity gives VCGs SLA-aware traffic engineering to data centers and automatic gateway and branch discovery, without administrators managing manual IPsec tunnels. A self-management portal gives enterprise administrators a single-pane-of-glass interface for managing users, applications, and policy across both remote users and branch offices.
VSPA & the Versa platform
VSPA is one of two subscription types inside Versa SSE, alongside Versa Secure Internet Access (VSIA); secure client-based access rules in Concerto select a subscription type per rule – VSPA, VSIA, or both – which determines available traffic actions. VSPA’s characteristic action is Breakout to Internet: private traffic tunnels to the VCG while internet-bound traffic exits locally, with specific custom or predefined applications selectable to force over the tunnel and Split DNS enabled by default. Administrators can further scope VSPA access by gateway group, source geographic location, and source IP address, and route prefixes for VSPA clients were limited to RFC 1918 private ranges in earlier releases before later releases added public-range support. On the Titan Portal side, Manage Users provisions VSPA (RAC/RAS) users – accounts authenticated locally on a SASE gateway, branch remote-access device, or multitenant RAC/RAS device – distinct from Versa IDP and external SSO user types.
Frequently asked questions
What is the difference between VSPA and VSIA?
VSPA is the ZTNA component of Versa SSE, brokering least-privilege access to private applications. VSIA (Versa Secure Internet Access) is the secure web gateway component, connecting users to public clouds, SaaS, and the internet. Both are configurable per subscription type on the same client and gateway.
What is the three-stage protection model VSPA uses?
Registration authenticates the client and downloads its configuration from the SASE portal. Connection determines connectivity behavior – gateway selection, encryption policy, trusted-network detection. Policy enforcement then applies corporate access, ZTNA, and SWG-style protections to the user’s ongoing traffic.
Does VSPA support clientless access?
Yes. Alongside the Versa SASE client for Windows, macOS, iOS, Android, Chromebook, and Linux, VSPA supports clientless connectivity for scenarios where installing an endpoint agent is not practical, while still enforcing identity-based access policy.
What is a VSPA (RAC/RAS) user in Titan Portal?
A VSPA (RAC/RAS) user is a locally authenticated account set up on a SASE gateway, branch remote-access VPN device, or multitenant RAC/RAS device. The option appears only for tenants who purchased the VSPA service with local authentication, and the user receives an email to register the VSPA client.
How does VSPA differ from a traditional VPN?
A traditional VPN concentrator grants network-level access controlled mainly by static access lists, which cannot distinguish user context. VSPA instead evaluates identity, device, and context continuously and scopes access to specific applications, following Zero Trust Network Access rather than broad network reachability.
More on VSPA
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages covering Versa SSE and the ZTNA capabilities VSPA delivers. | How Versa’s SD-WAN overlay underpins the SD-WAN-enabled connectivity VSPA’s cloud gateways provide. | Versa’s training portal: courses covering SSE, ZTNA, and secure client-based access configuration. |
Related terms
If you’re reading about VSPA, these are worth looking at next.
| Versa Secure Access Fabric | SSE Gateway | Zero Trust Network Access |
|---|---|---|
| The tenant bundle that packages VSPA together with VSIA and Secure SD-WAN into licensed editions. | The enforcement point that terminates VSPA client connections and applies access and threat policy. | The security framework VSPA implements: continuous identity and context verification over broad network trust. |