What is a WAN Edge?

A WAN edge is the appliance or device – physical or virtual – that terminates a site’s wide-area transport circuits, such as MPLS, broadband internet, and LTE/5G, and connects that site’s users and applications to the rest of the network through SD-WAN, quality of service, DHCP, and routing, typically a VOS-enabled appliance at a branch, campus, or data center.

Key takeaways

• A WAN edge terminates a site’s MPLS, internet, and LTE/5G links.
• It runs SD-WAN, QoS, DHCP, and routing at the network boundary.
• Delivered as a physical or virtual VOS-enabled appliance or device.
• Deployment ranges from single-device branches to active–active HA pairs.
• Versa delivers WAN edge through CSG appliances and Secure SD-WAN.

On this page: Why it matters · How it works · Types · WAN Edge & Versa · FAQ

Why is a WAN Edge important?

Every branch, campus, or data center needs a point where its local network meets its wide-area transport – MPLS, broadband internet, LTE/5G. That boundary used to be a stack of separate boxes: a router for connectivity, a firewall for security, sometimes a WAN optimizer and a DHCP server, each with its own console and failure point.

The WAN edge collapses that stack into one appliance or virtual device. It’s the connectivity half of a SASE architecture – steering traffic across whichever transport performs best, prioritizing traffic with QoS, assigning addresses with DHCP, and routing it onward – while the security half enforces what that traffic may do. Because it’s provisioned centrally and activated with zero-touch provisioning, a new site reaches production without a network engineer on-site.

What is a WAN Edge?

A WAN edge is any physical or virtual VOS-enabled device deployed at the boundary between a site’s LAN and its WAN transports. The same appliance works as a branch device, a hub, or a gateway – the role comes from configuration, not hardware.

At minimum, a WAN edge terminates one or more transport circuits and forms the SD-WAN overlay to other WAN edges and the Controller nodes that orchestrate the network. From there it applies the functions that define the role: DHCP, static or dynamic routing (OSPF, BGP), QoS for latency-sensitive traffic, and NAT/CGNAT when it breaks traffic out locally to the internet.

WAN edge devices are typically activated through zero-touch provisioning: global ZTP activates a device automatically on power-up, while URL-based ZTP, CLI, and USB-based staging cover onsite activation.

Types of WAN Edge deployments

WAN edge deployments vary by how many devices sit at a site and how they connect to transports. Single-device deployments use one device terminating two or more WAN transports – the simplest model, suited to small branches.

Active–active dual-device deployments pair two WAN edge devices, each anchoring a different transport, connected over a cross-connect link so each can reach the other’s transport if needed. Both forward traffic at all times; VRRP provides LAN-side redundancy. A stateful variant keeps NAT and firewall session state synchronized between the two.

Gateway or hub WAN edges take on a third role: instead of connecting one site outward, they interconnect other WAN edges to networks the SD-WAN doesn’t natively reach – an MPLS VPN, a legacy network mid-migration, or a shared internet breakout point other branches route through.

WAN Edge & Versa

Versa’s WAN edge devices run VOS as physical appliances – the Cloud Services Gateway (CSG) series, from compact CSG150 units to high-capacity data-center models – or as virtual and cloud instances. Versa Secure SD-WAN is the software that turns a VOS device into a WAN edge: routing, SD-WAN overlay, QoS, and NGFW in one licensed stack.

New devices come online through zero-touch provisioning – global ZTP, URL-based ZTP, CLI, or USB-based staging – without a site visit. Deployment models are documented in the Consolidated SD-WAN Design Guide. Versa continues publishing WAN edge appliance guides, including recent hardware documentation covering the CSG2500 and CSG150 series.

Frequently asked questions

How does a WAN edge differ from a router?

A router only forwards packets across one link. A WAN edge is a VOS appliance that adds SD-WAN path selection across multiple transports, QoS, DHCP, and often NGFW – routing is one function among several it performs, not the whole job.

Is a WAN edge the same as CPE?

Largely, yes – customer premises equipment (CPE) is the general term for equipment at a customer site, and a WAN edge device is CPE purpose-built to run SD-WAN, QoS, routing, and security together instead of acting as a plain router.

Can one device be both a branch WAN edge and a gateway?

Yes – the role is set by configuration, not hardware. The same appliance can run as a branch device terminating local transports, a hub aggregating spoke sites, or a gateway importing routes from an MPLS VPN or a legacy network.

How is a new WAN edge device activated?

Most commonly through zero-touch provisioning: the device calls home on power-up and a staging Controller pushes configuration automatically (global ZTP), or an installer clicks an emailed link (URL-based ZTP). CLI and USB-based staging cover cases without internet reachability or centralized inventory.

Does a WAN edge handle security, or just connectivity?

Its core role is connectivity – SD-WAN, routing, QoS, DHCP – the network half of a SASE architecture. Many WAN edge appliances also run NGFW and other security functions locally, but in a full SASE deployment the cloud-delivered security half enforces most policy.

More on WAN Edge

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about WAN Edge, these are worth looking at next.