What is ZT-LAN?

Zero-Trust LAN (ZT-LAN) is Versa Networks’ on-premises LAN architecture, combining ZT Edge and Secure SD-LAN to deliver Zero Trust Network Access, microsegmentation, and software-defined campus and branch networking. It runs the Versa Operating System (VOS) directly on Ethernet switches, WLAN access points, and on-premises appliances.

Key takeaways

• ZT-LAN combines ZT Edge and Secure SD-LAN in one on-premises architecture.
• Runs VOS on Ethernet switches, WLAN access points, and appliances.
• Embeds a full security stack, eliminating dedicated firewall appliances.
• 802.1X, device fingerprinting, and user policy control network access.
• EVPN VXLAN overlays extend microsegmentation across LAN devices.

On this page: Why it matters · How it works · ZT-LAN components · ZT-LAN & Versa · FAQ

Why is ZT-LAN important?

Campus and branch LANs have traditionally been a trusted zone once a device gets past the front door – a model that lets one compromised endpoint move laterally largely unchecked. ZT-LAN inverts that assumption: every device is fingerprinted, authenticated, and matched to policy, and Layer 3 through Layer 7 security functions run inline, close to the user, instead of being backhauled to a distant firewall.

That inline placement removes a piece of hardware most LAN designs assume is mandatory: a dedicated firewall appliance. Because the full security stack – NGFW, UTM, IPS, malware protection – is embedded in each secure Ethernet switch, secure WLAN access point, and ZT-LAN appliance, enforcement happens at wire rate where the traffic already is. Standards-based interoperability keeps that stack usable on multivendor LANs, avoiding vendor lock-in, while device fingerprinting and 802.1X give IT visibility into the IoT and BYOD devices now dominating most LAN port counts.

What is ZT-LAN?

ZT-LAN combines ZT Edge (Zero Trust enforcement applied close to the user) and Secure SD-LAN (unified switching, routing, and security for the LAN), both running as part of VOS. Stateful functions – the same ones that power VOS elsewhere in the Versa platform – run embedded on the LAN hardware, while stateless Layer 2 and Layer 3 functions execute at wire rate on the switches and access points, using hardware offload engines for line-rate ZTNA enforcement and microsegmentation.

A policy engine spanning Layer 3 through Layer 7 evaluates applications, URLs, and contextual signals like location to allow, block, rate-limit, or classify traffic. Unified Threat Management (UTM) scans payloads for malware and exploits in both north-south and east-west directions, and can be applied dynamically – for example, to a device on-premises ZTNA flags as out of compliance. Multitenancy and microsegmentation policies separate each tenant’s traffic, applications, and devices across the management, control, and data planes, using VRFs, virtual switches, and IRB interfaces.

ZT-LAN components

Access control comes in two forms. Clientless access control uses 802.1X for certificate-based authentication and microsegment placement, device fingerprinting (Dev-ID) to classify IoT, corporate, and BYOD endpoints, and user/group access control via captive portal or an identity provider such as Active Directory. Client-based access control uses the Versa Secure Private Access (VSPA) client, which builds an Endpoint Information Profile – OS version, patch level, disk encryption, antivirus status – and reports it to the nearest VOS instance for policy enforcement; the client works tunnel-less on the trusted LAN and tunneled remotely.

EVPN control plane and VXLAN overlays extend Layer 2 segments across ZT-LAN devices. MP-BGP distributes MAC and IP routing information between leaf-and-spine ZT-LAN devices acting as VXLAN tunnel endpoints, mapping VLANs to VXLAN network identifiers so multitenant traffic stays isolated at campus scale – see Configure EVPN VXLAN for ZT-LAN. Hosts can multihome to two or more ZT-LAN devices in all-active or single-active mode for redundancy, detailed in Configure EVPN multihoming for hosts using ZT-LAN.

Centralized management runs through the Versa Concerto Orchestrator, giving one portal for policy design, device and service monitoring, hierarchical multitenancy with role-based access control, and third-party API and cloud-platform integration.

ZT-LAN & Versa

ZT-LAN is the LAN-layer counterpart to Versa’s SD-WAN offerings, sharing the same VOS foundation, the same Concerto-based single pane of glass, and the same Versa Analytics engine that turns device telemetry into behavior analysis, per-user traffic reporting, and near-real-time topology insight. Ethernet switches, WLAN access points, and on-premises appliances all run VOS as ZT-LAN devices, so a policy or segmentation design uses the same control-plane concepts – organizations, virtual switches, virtual routers – as the rest of a Versa deployment. Full feature and capability detail is documented in ZT-LAN features and capabilities.

Frequently asked questions

What is the difference between ZT-LAN and Secure SD-LAN?

ZT-LAN is the broader on-premises LAN architecture, combining ZT Edge (Zero Trust enforcement close to the user) with Secure SD-LAN, which is specifically the unified switching, routing, and security layer for campus and branch LANs.

Does ZT-LAN require a separate firewall appliance?

No. The full security stack – NGFW, UTM, IPS, malware protection – is embedded directly in each secure Ethernet switch, secure WLAN access point, and ZT-LAN appliance, so security enforcement happens inline without a dedicated firewall box.

How does ZT-LAN decide whether a device can access the network?

Through either clientless controls – 802.1X authentication and device fingerprinting that classifies IoT, corporate, and BYOD devices – or the client-based VSPA client, which builds an endpoint profile and reports it to the nearest VOS instance for policy enforcement.

What role does EVPN play in ZT-LAN?

EVPN is the control plane that distributes MAC and IP reachability between ZT-LAN devices using MP-BGP, while VXLAN provides the data-plane overlay that extends Layer 2 segments and multitenant isolation across the campus.

How is a ZT-LAN deployment managed?

Through the Versa Concerto Orchestrator, a single-pane-of-glass portal that provides centralized policy management, hierarchical multitenancy with role-based access control, device and service monitoring, and integration with third-party and cloud management systems.

More on Versa hardware

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ZT-LAN, these are worth looking at next.