What is CPE?

Customer premises equipment (CPE) is networking hardware installed at a customer’s site – a branch, retail location, or data center – that terminates a service provider’s WAN circuits and connects the site to the wider network. In a Versa SD-WAN deployment, the CPE is the VOS branch appliance anchoring every WAN link, tunnel, and policy at that site.

Key takeaways

• CPE is the networking gear installed at a customer’s physical site.
• It terminates WAN circuits – MPLS, internet, LTE/5G – from the provider.
• Deployments range from a single CPE to active-active HA CPE pairs.
• A service provider or the enterprise itself can own and manage the CPE.
• Versa’s VOS branch appliance is the CPE running SD-WAN and security.

On this page: Why it matters · How it works · Types · CPE & Versa · FAQ

Why is CPE important?

Every WAN connection a business buys – MPLS, broadband internet, LTE, or 5G – has to terminate somewhere on the customer’s side, and that somewhere is the CPE. It is the boundary device between the provider’s network and the customer’s own LAN, which makes it the single point where routing, security, and SD-WAN policy for a site actually take effect.

CPE choices shape resilience and cost. A branch with a single CPE device is simple to deploy but has no local hardware redundancy; a branch with two CPE devices in an active-active or active-standby high-availability pair survives a device failure without an outage, at the cost of an extra appliance and a cross-connect link. Because the CPE sits at the network edge, it also carries the operational burden: firewall enforcement, VRRP gateway redundancy for the LAN, BFD-based fast failure detection, and usage-statistics export all run on it. Getting the CPE model right – how many devices, which transports, and who manages them – is one of the first decisions in any WAN or SD-WAN design.

What is CPE?

CPE covers any device that sits at a customer’s physical location and connects that location to a provider’s network – traditionally a modem or router, and in SD-WAN deployments a purpose-built edge appliance. The CPE terminates the WAN transport (MPLS, internet, LTE/5G) on one side and the customer’s LAN on the other, forwarding traffic between them according to the routing and security policy configured on the device.

Who owns the CPE varies by model. It can be hosted and managed by the service provider on behalf of the enterprise, procured and self-managed by the enterprise, or run as a virtual instance on shared compute. In an SD-WAN context, the CPE is also the SD-WAN’s own policy enforcement point: it runs the overlay tunnels to controllers and other sites, applies application-aware path selection across the available transports, and typically enforces the branch’s next-generation firewall. A single CPE device can also serve multiple tenants at once, with each tenant’s traffic kept in its own virtual routing and forwarding instance.

Types of CPE

Deployments generally fall into a few patterns. Single CPE puts one device at the site handling one or more WAN transports – the simplest model, configurable through a workflow template, and suitable for single-tenant or multi-tenant branches with VRF-based segmentation. Dual CPE, active-active HA pairs two devices connected by a physical cross-connect link, with each device terminating its own WAN transport and VRRP providing LAN-side gateway redundancy; both devices carry traffic simultaneously, though NAT and session state are not synchronized between them. Dual CPE, active-standby HA skips the cross-connect and instead physically attaches both transports to both devices, with only the active device forwarding traffic – simpler cabling, at the cost of losing stateful sessions on failover. A fourth pattern, universal CPE (uCPE), replaces function-specific hardware with a compute-capable platform that can host third-party virtual network functions alongside native SD-WAN services on one box. Physical form factors range from small branch appliances to higher-throughput chassis; virtual CPE further loosens the coupling to hardware by running as an instance in a private or public cloud.

CPE & Versa

In a Versa SD-WAN deployment, the CPE is the VOS branch appliance – a physical device (such as a Versa CSG) or a virtual instance hosted in a cloud like Azure. Versa Director workflows automate CPE provisioning for every topology: single-CPE branches, active-active HA pairs joined by a cross-connect link, and active-standby pairs, supporting up to 15 WAN links per tenant per device on current releases. Each CPE enforces next-generation and stateful firewall for its site, runs BFD for fast failure detection against customer routers, and exports usage statistics to Analytics.

Branches that also connect into Versa SSE use the CPE – called the VOS branch in that context – to build site-to-site IPsec tunnels to a cloud-hosted Secure Cloud Gateway, with VRRP failing traffic to a standby CPE if the active tunnel drops. The Consolidated SD-WAN Design Guide documents the full set of supported CPE topologies and best practices.

Frequently asked questions

What is the difference between CPE and uCPE?

Standard CPE is typically a purpose-built appliance running one vendor’s networking software. Universal CPE (uCPE) adds compute capacity so the same box can also host third-party virtual network functions – a virtualized firewall or WAN optimizer, for example – alongside native services, consolidating what would otherwise be several separate appliances.

Who owns and manages the CPE?

Either party. A service provider can host and manage the CPE on the customer’s behalf as part of a managed service, or the enterprise can procure, deploy, and operate the device itself on its own headend – the choice affects support responsibility but not how the device functions on the network.

What is the difference between single-CPE and dual-CPE branch deployments?

A single-CPE branch uses one device to terminate every WAN transport at the site – simple, but with no hardware redundancy if that device fails. A dual-CPE branch pairs two devices in an active-active or active-standby high-availability configuration, so a device failure does not take the site offline.

What is a cross-connect link?

A cross-connect link is a physical connection between two CPE devices in an active-active HA pair. It carries each device’s transport traffic to its partner so both CPEs can use both WAN circuits, even though each circuit physically terminates on only one of the two devices.

Can CPE be virtual instead of physical hardware?

Yes. Virtual CPE (vCPE) runs the same networking functions as software on standard x86 compute instead of dedicated appliance hardware – including as a cloud-hosted instance in a provider like Azure – trading purpose-built hardware for flexibility and easier scaling.

Related terms

If you’re reading about CPE, these are worth looking at next.