Building Enterprise-Ready Remote Sites with Versa and Starlink

For a growing number of remote sites, a dish on the roof is the only practical way to get connected. These are locations with no fiber, no usable cellular and no circuit that anyone can provision easily. Starlink has made that connectivity a reality for these locations, with broadband-class capacity and low-earth-orbit (LEO) latency, delivered in days rather than months.

But simply having a working internet link is not the same as having a working branch. Applications at these sites bring the same demands as any other business location including connected resiliency, network optimization, encryption, centralized monitoring, management and deployment, and more. Versa Secure SD-WAN and Versa SASE delivers these capabilities, and with Starlink offers a complete enterprise ready network and security solution for remote or branch offices that cannot be serviced through other connectivity methods.

To validate the capabilities between Versa and Starlink, a technical investigation into the solution was performed by solutions engineering, where they tested what happens when Versa Secure SD-WAN is layered over Starlink. Let’s explore what it means to use Starlink as the underlay network for Versa Secure SD-WAN, and why this is the right choice for your remote sites.

Why Starlink, and why Versa Secure SD-WAN on top of it

For a site with no cellular and no connected circuits, the case for Starlink is simple:

• It makes the site reachable. Starlink serves locations where terrestrial circuits are unavailable, uneconomic or very slow to provision.
• Starlink’s LEO architecture provides broadband connectivity with latency characteristics suitable for a broad range of enterprise applications.
• Capacity is broadband class, supporting demanding enterprise connectivity requirements at remote locations.
• It can be offered as a primary or secondary, physically independent path. Even where a site has a terrestrial circuit, Starlink doesn’t share its failure domain, providing a cost-effective solution for resiliency when applicable.

With Starlink providing the high-performance access layer, enterprises can then use Versa Secure SD-WAN, a part of the Versa SASE platform, to gain additional features that most enterprises require for their wider network, including tunnel forwarding, load balancing, TCP optimization, packet cloning, forward error correction, header compression, and local breakout for applications requiring direct Internet access. Versa Secure SD-WAN also delivers centralized management, observability, and provisioning that can help larger enterprise organizations scale to thousands of sites. With one centralized team, you can deploy, operate, and monitor several profiles at once, chosen per application, as needed per site.

Versa and Starlink solution overview

In the technical validation, two independent Starlink terminals were deployed, providing the underlay network for a single Versa Secure SD-WAN branch appliance and its SD-WAN tunnel (overlay) to a Versa hub in a public cloud region. Different operations were measured featuring sixteen forwarding profiles across both TCP and UDP, in both directions, plus additional scenarios where induced terminal outages occurred.

The summary points of the technical validation:

1. Two Starlink terminals remain separate SD-WAN paths, but Versa Secure SD-WAN can use them together as one logical service, actively distributing traffic across both links. In our validation, sustained aggregate throughput exceeded 300 Mbps for TCP traffic and exceeded 450 Mbps for UDP traffic across the two terminals. Actual throughput will vary with service conditions, traffic characteristics, forwarding mode, terminal performance, and time of day.
2. In our induced terminal outage test, tunneled application flows continued without observed interruption. When one terminal was disabled, Versa Secure SD-WAN shifted the affected traffic to the surviving path. After restoration, traffic was redistributed across both terminals.

3. Throughput performance should be based on application requirements. In our validation, local breakout delivered higher aggregate throughput for direct Internet traffic, while tunneled sessions provided additional capabilities including encryption, path selection, per-path SLA measurement, and session continuity.
4. TCP optimization is best for single flows. As concurrency in the number of sessions rises, the TCP optimization effect fades. Apply TCP optimization to the application flows that need it, such as backups, replication, large transfers and software distribution.
5. Use QoS to protect latency-sensitive traffic at the branch with per-class queuing and egress shaping set below the terminal’s usable rate.
6. Combining Starlink terminal telemetry with Versa SD-WAN SLA measurements helps isolate whether degradation is occurring on the Starlink access segment or elsewhere along the end-to-end SD-WAN path.

Designing the whole site

Several design topics matter in practice even though the technical validation does not cover them. Consider these additional design topics when considering if Starlink is an appropriate fit for your Versa Secure SD-WAN deployment at a site.

• Starlink acts as a singular link, but it doesn’t have to be alone. Many sites pair it with a terrestrial or cellular link. A single VOS instance supports up to 15 WAN links, so multi-link designs are easily within reach depending on the site requirements.
• If using multiple network links, don’t treat unlike paths as equal load-balancing candidates. When Starlink is combined with links of materially different latency, assign path priority and use policy so each application prefers the path that fits it. Reserve the other transport links for selected traffic or resilience. This avoids reordering and timing effects. Packet cloning is also a poor fit for very unlike paths, because the late copy may arrive after the receiver’s reordering window closes.
• Understand the performance asymmetry. Starlink uplink capacity is materially lower than downlink. Define acceptance criteria per direction and size test loads inside available capacity. Allow a warm-up window: for example, UDP runs took 20 to 30 seconds to settle.
• Establish per-class queuing and egress shaping at the branch, set below the terminal’s usable rate. Keep bulk and guest traffic from competing with critical applications for a thin uplink.
• Operate it like production. Pair per-path SLA measurement on the tunnel with terminal telemetry. Record baselines across different times of day, and keep an inventory tying each terminal, router and service account to a site and a support owner. Test failure and failback as separate cases before rollout.

Making the use case justification for Versa and Starlink

The common thread where Versa Secure SD-WAN with Starlink is justified is a site where terrestrial options are missing, slow or fragile, and where applications still need enterprise behavior. But Versa Secure SD-WAN with Starlink also fits nicely for additional use cases where they may be deployed as secondary or tertiary connection points to bolster existing network paths. Such use cases include:

• Remote and rural branches. Clinics, bank outposts, travel centers and retail locations with no fiber and weak cellular, needing private application access, encrypted transport to a hub, and sessions that survive a path problem.
• Temporary and rapid-deployment sites. Construction trailers, seasonal and pop-up retail, event sites and disaster-response command posts need connectivity now, well before trenching or provisioning is possible. A second Starlink terminal adds capacity and resilience.
• Resource and industrial sites. Mines, energy and logistics yards can use Starlink as the primary path for OT, IoT and per-application policy and clear fault isolation.
• Critical sites. A pair of Starlink terminals gives a site two independent paths with active load sharing and tested failover, not an idle spare.
• New-site bring-up. Starlink can carry a site on day one, then become the diversity path when a terrestrial circuit arrives later on. Deployments can be actively sped up for large scale operations with multiple sites needing fast, centralized deployments.
• Mobile and maritime use.

Note: Applicability of performance and use cases is dependent on Starlink availability and access to LEO satellite placements. Measurements from the technical validation were taken at a fixed site under clear sky and consistent measurement conditions.

Summary

Simply put, Starlink solves for the problem of remote network reach, as well as provides a critical secondary pathway for other use cases. When paired with Versa Secure SD-WAN and Versa SASE, a branch can provide full enterprise level capabilities for user and application needs across a wide spectrum of use cases.