What is a Branch?

A branch is a remote office or site location connected to an organization’s wide-area network – typically through one or more WAN circuits terminating on a branch appliance, or CPE – so that users and devices there can reach data-center resources, the internet, and other branches according to network and security policy.

Key takeaways

• A branch is a site connected to the WAN through a CPE appliance.
• SD-WAN branches build overlay tunnels to hubs, peers, and the cloud.
• Branch HA pairs two appliances in active-active or active-standby mode.
• Topology choice – full mesh, hub-and-spoke, partial mesh – shapes reach.
• Direct internet access lets branches break out locally, not centrally.

On this page: Why it matters · How it works · Types · Branches & Versa · FAQ

Why are branches important?

A branch is where an organization’s business actually happens – a retail counter, a clinic, a plant floor, a regional office – and it is the edge of the WAN, where local users and devices meet the circuits, policy, and security connecting them to everything else. How well it is designed determines whether an outage takes the site offline or fails over transparently.

Branches matter operationally because there are usually many of them, and each is a potential point of failure – a misconfigured branch can leak traffic, drop a circuit, or become the weak link an attacker enters through. SD-WAN reframed the branch from a fixed circuit hairpinned to a data center into a policy-driven edge that reaches the cloud, a hub, or a peer branch directly.

What is a branch?

At a minimum, a branch is a site with one or more WAN circuits – internet, MPLS, LTE/5G – terminating on a piece of customer-premises equipment (CPE): a router or SD-WAN appliance that provides connectivity for the LAN behind it. In an SD-WAN deployment, that appliance runs SD-WAN software, registers with a controller for its control plane, and builds encrypted overlay tunnels across the underlay circuits to reach a hub, a data center, the cloud, or other branches directly.

What a branch can reach is governed by policy, not fixed wiring: the same appliance can be a spoke that only talks to a hub, a full-mesh participant that reaches every peer directly, or a multitenant device serving several organizations at once – all without swapping hardware.

Types of branch deployments

Branch deployments vary mainly by how many CPE devices and WAN circuits a site has. A single-CPE branch terminates one or more WAN links – commonly internet and MPLS, sometimes with LTE as backup – on one appliance; it is the simplest, most common design. A dual-CPE active-active branch pairs two appliances, each terminating its own transport, joined by a physical cross-connect link so either device can reach the other’s transport if its own link fails – the standard HA model, alongside a less common active-standby mode. A hot-standby LTE branch keeps a cellular link up for SLA probing but only forwards traffic once wired links fail. Some branches also act as gateway or transit branches, relaying traffic between sites with no common underlay.

Branches & Versa

In Versa’s architecture, a branch runs a VOS (Versa Operating System) device – a physical appliance such as a CSG, or a virtual instance in a public cloud – connected to the headend’s Controller nodes for its control plane and to Director for configuration and lifecycle. Branch HA, topology (full mesh, hub-and-spoke, spoke-to-spoke via hub, partial mesh, or regional spoke-hub-hub-spoke), and direct internet access are all configured through Director Workflow templates rather than box-by-box. See the consolidated SD-WAN design guide and the Versa SD-WAN design guide for deployment options and topology trade-offs.

Branches also extend into SASE: where Secure SD-WAN and Versa’s cloud-hosted SSE run on separate infrastructure, a branch’s VOS device builds site-to-site IPsec tunnels to a Versa Cloud Gateway so branch users get SWG, CASB, and ZTNA enforcement without a separate access method. See Versa Secure SD-WAN Integration with Versa SSE for the tunnel topologies.

Frequently asked questions

What is the difference between a branch and a hub?

A branch is an edge site – an office, store, or remote location – while a hub is a site other branches route through to reach each other. The same appliance type can be configured as either; the difference is topological role, not hardware.

What connects a branch to the rest of the WAN?

One or more WAN circuits (internet, MPLS, LTE/5G) terminate on the branch’s CPE appliance, which builds encrypted overlay tunnels across those circuits to a controller, a hub, a data center, or other branches, depending on the configured topology and policy.

What is branch HA and why does it matter?

Branch high availability pairs two appliances at a site, most commonly in active-active mode with a cross-connect link, so a failed device or WAN link does not take the site offline. A single-appliance branch has no local failover if that device fails.

What is direct internet access (DIA) at a branch?

DIA lets a branch send internet- and SaaS-bound traffic straight out its local circuit instead of backhauling it to a central hub. It improves performance for cloud applications but requires local security controls, since the branch becomes its own internet edge.

Can a single branch appliance serve multiple tenants?

Yes. A Versa VOS edge device supports multitenancy natively: each organization on the appliance gets its own virtual routing and forwarding (VRF) instance and policy set, so one physical or virtual device can serve several separate customers or business units at once.

More on branches

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about branches, these are worth looking at next.