A Cloud Services Gateway (CSG) is a Versa Networks hardware appliance built to run the Versa Operating System (VOS) at sites: branch offices, campuses, and WAN edges. One CSG delivers what traditionally took a stack of boxes – SD-WAN, next-generation firewall, routing, switching, and Wi-Fi – as a single device managed from the Versa headend.
Key takeaways
- CSG appliances are purpose-built hardware for running VOS at sites.
- One box converges SD-WAN, security, routing, switching, and Wi-Fi.
- Series span small branches (CSG150/300) to high-end sites (CSG5000).
- Modular NICs add DSL, LTE/5G, PoE, and fiber options per site.
- Zero-touch provisioning onboards a CSG from factory state to production.
On this page: Why it mattersHow it worksCloud Services Gateway seriesCloud Services Gateways & the VersaONE platformFAQ
Why are Cloud Services Gateways important?
The branch is where networking ambitions meet physical reality: a wiring closet, a couple of uplinks, and no on-site engineer. CSG appliances exist to make that site a full citizen of a modern SASE network without a rack of specialist boxes. Because the same VOS software runs across every model, a design built once – templates, security policy, segmentation – deploys identically to a two-person office and a thousand-user campus; only the hardware size changes.
Consolidation is the other half of the argument. Replacing separate router, firewall, WAN optimizer, and switch stacks with one appliance cuts cost and power, but more importantly it removes integration seams – one policy engine sees all traffic, and one management plane owns the whole site. Zero-touch provisioning completes the operational story: a CSG ships to site, is cabled by anyone, and pulls its full configuration from the headend.
What is a Cloud Services Gateway?
A CSG is an x86-based appliance engineered around VOS: hardware-accelerated encryption for the SD-WAN overlay, front-panel port mixes matched to site profiles (copper and fiber LAN, PoE for phones and cameras on many models), and modular expansion bays. Network interface card (NIC) modules add WAN and access technologies per site – DSL variants, LTE/5G cellular, additional fiber – and Wi-Fi modules serve smaller sites without separate access points.
Deployment follows the platform’s site model: the CSG terminates WAN circuits, builds encrypted SD-WAN paths to hubs, gateways, and peers, enforces the site’s security policy inline, and – in Secure SD-LAN designs – acts as the site’s core switch and policy enforcement point for the LAN itself.
Cloud Services Gateway series
The family is tiered by site size and throughput. CSG150 and CSG300 series serve small branches and home offices, with integrated Wi-Fi and LTE options. CSG700 and CSG1000 series cover mid-size branches with PoE port density and modular WAN expansion – see the CSG1000 hardware guide for a representative model. CSG2500, CSG3000, and CSG5000 series address large sites, campuses, and aggregation roles with 10/25/100-Gigabit interfaces and higher encrypted throughput. Sibling families complete the hardware line: CSX switches for Secure SD-LAN fabrics and CSM appliances for management-plane roles.
Cloud Services Gateways & the VersaONE platform
A CSG is the physical embodiment of the platform at a site: it runs the same VOS that powers virtual and cloud instances, onboards through Director or Concerto zero-touch workflows, and reports telemetry to Versa Analytics. Every VersaONE service a site consumes – Secure SD-WAN, next-generation firewall, SD-LAN switching and access control – executes on the CSG inline, under policies orchestrated centrally. Hardware support tiers, RMA processes, and per-model specifications are documented per series in the hardware section of this portal.
Frequently asked questions
What is the difference between a CSG and an ordinary branch router?
A router forwards packets; a CSG runs the site’s whole network stack – SD-WAN path selection, next-generation firewall, segmentation, switching, and Wi-Fi – under one policy engine, centrally orchestrated. The router’s job is one feature among many on the device.
How do I choose the right CSG model for a site?
Size by encrypted SD-WAN throughput, user count, and port needs: CSG150/300 for small sites, CSG700/1000 for mid-size branches needing PoE and modular WAN, CSG2500 and above for campuses and aggregation. Per-model specification guides list the exact capacities.
Can a CSG replace the site’s switch and access points?
Often, yes. Many CSG models carry PoE-capable switch ports, and smaller models offer integrated Wi-Fi; larger LAN fabrics pair the CSG with CSX series switches under the same Secure SD-LAN policy model.
Does the same software run on all CSG models?
Yes. Every CSG runs VOS, so features and policy behave identically across the family – a design validated on one model deploys unchanged to the rest of the fleet, and models differ mainly in capacity, ports, and modules.
How does a new CSG get its configuration?
Through zero-touch provisioning: the appliance ships in factory state, reaches the Versa headend on first boot, authenticates, and pulls the full site configuration bound to it from templates – no on-site engineering visit required.
More on Versa hardware
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including the appliance families and their positioning. | The service the appliances deliver, as packaged by the vendor. | Training and labs that deploy CSG hardware hands-on, from unboxing to production. |
Related terms
If you’re reading about Cloud Services Gateways, these are worth looking at next.
| Versa Operating System | Cloud Services Switch | Zero-Touch Provisioning |
|---|---|---|
| The software every CSG runs: SD-WAN, security, routing, and switching in one stack. | The CSX switch family that extends Secure SD-LAN fabrics beneath CSG gateways. | The onboarding model that takes a factory-fresh appliance to full production remotely. |