A Cloud Services Switch (CSX) is a Versa Networks hardware appliance built to run the Versa Operating System (VOS) as a secure SD-LAN switch – at the network edge, access layer, aggregation layer, or core. Each CSX pairs an Ethernet switch chipset with x86 compute, converging line-rate switching, routing, and integrated security in one appliance.
Key takeaways
- CSX appliances are purpose-built SD-LAN switching hardware that runs VOS.
- One box converges Ethernet switching, routing, and inline security.
- Series span LAN edge/access (CSX2000, CSX4000) to core (CSX8000).
- PoE++ ports power phones, cameras, and access points at the edge.
- Director and Analytics provide provisioning, monitoring, and telemetry.
On this page: Why it mattersHow it worksCloud Services Switch seriesCloud Services Switches & the VersaONE platformFAQ
Why are Cloud Services Switches important?
Modern LAN edges carry as much risk as WAN edges – device sprawl, IoT endpoints, and lateral movement inside a campus rarely get the scrutiny paid to the WAN and cloud edge. CSX appliances extend Secure SD-LAN principles down to the access port: every device that plugs in is identified, segmented, and admitted under policy, not just switched. Because a CSX runs the same VOS as Versa’s WAN-edge and firewall products, LAN access control, micro-segmentation, and ZTNA are unified with the rest of the VersaONE fabric instead of bolted on with a separate NAC product.
Consolidation matters too: a CSX pairs an Ethernet switch chipset with x86 compute in one chassis, so routing, security, and switching run inline on the box moving the packets – no separate appliance chained behind it to inspect traffic. That collapses a switch-plus-firewall-plus-NAC stack into one appliance, tiered by throughput.
What is a Cloud Services Switch?
A CSX is an appliance built around an Ethernet switch chipset paired with an x86-based processor subsystem, both running under VOS. The switch chipset delivers line-rate Layer 2 and Layer 3 forwarding and PoE++ power (up to 90 W per port) to connected endpoints; the x86 subsystem runs VOS stateful functions – NGFW, UTM, on-premises ZTNA, inline device fingerprinting, network access control, and micro-segmentation – inline on the same appliance, plus optional third-party virtual machines.
Every CSX integrates a TPM chip with hardware cryptographic acceleration, secure BIOS, and secure boot to protect the keys and firmware it depends on. Interfaces range from dense PoE++ copper for LAN edge and access ports up to SFP28 25/10-Gigabit and QSFP28 100-Gigabit Ethernet for switch uplinks, so a single CSX model can serve as an access switch or, on larger models, as an aggregation or core switch.
Cloud Services Switch series
Three series cover the SD-LAN from edge to core, tiered by port mix and switching capacity – every model runs the same VOS. CSX2000 series (CSX2200, CSX2300) is the entry edge and access switch, with 24 or 48 PoE++ Gigabit Ethernet ports plus SFP+ 10-Gigabit uplinks – see the CSX2000 hardware guide. CSX4000 series (CSX4300, CSX4500) steps up to large branches, campuses, and data centers, adding SFP28 25/10-Gigabit and QSFP28 100-Gigabit switch ports alongside dense PoE++ access ports; see the CSX4000 hardware guide. CSX8000 series (CSX8300, CSX8500) drops PoE and copper access ports to focus on aggregation, core, and data-center top-of-rack switching, with all-fiber interfaces and capacity up to 3.2 Tbps per direction – see the CSX8000 hardware guide.
Cloud Services Switches & the VersaONE platform
A CSX runs the same VOS that powers Versa’s Cloud Services Gateways and virtual instances, so LAN switching policy – segmentation, access control, inline security – is written once and enforced identically across every appliance in the fabric. Director provisions, configures, and monitors CSX appliances, while Analytics collects device, network, and security telemetry from them – the same management plane used across the rest of the VersaONE platform.
In Secure SD-LAN designs, CSX switches typically sit beneath or alongside Cloud Services Gateways at a site: the CSG anchors WAN connectivity and SD-WAN path selection, while CSX switches extend that same policy engine down to individual access ports instead of stopping enforcement at the WAN edge.
Frequently asked questions
What is the difference between a CSX and a traditional campus switch?
A traditional switch forwards frames and, at best, applies static VLANs and ACLs. A CSX runs VOS, so the same appliance inline-inspects traffic with NGFW/UTM, fingerprints and admits devices via ZTNA and access control, and micro-segments the LAN under one centrally orchestrated policy.
Which CSX series should I choose for my site?
Match the series to the role: CSX2000 for small-to-mid access layers, CSX4000 for large branches, campuses, or data centers needing both PoE access and high-speed uplinks, and CSX8000 for aggregation, core, or top-of-rack switching where Tbps-class capacity matters more than PoE.
Can a CSX replace a standalone firewall at the LAN edge?
Largely, yes, for LAN-facing traffic – built-in NGFW, UTM, and ZTNA functions run inline as packets cross the switch itself. A CSX complements, rather than replaces, the perimeter firewall functions a Cloud Services Gateway delivers at the WAN edge for that same site.
Does a CSX need a Cloud Services Gateway to work?
No – a CSX operates as a standalone SD-LAN switch, managed by Director. Sites that also need WAN connectivity and SD-WAN pair CSX switches with CSG appliances, but the two families serve LAN and WAN edges independently of each other.
How is a CSX provisioned and monitored?
Like other VOS appliances, a CSX is configured and monitored from Versa Director, with Versa Analytics providing device, network, and security telemetry across the fleet. It expects centralized management via Director or Concerto rather than standalone, box-by-box CLI administration for day-to-day operations.
More on Versa hardware
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including the appliance families and their positioning. | The service the appliances deliver, as packaged by the vendor. | Training and labs that deploy CSX hardware hands-on, from unboxing to production. |
Related terms
If you’re reading about Cloud Services Switches, these are worth looking at next.
| Cloud Services Gateway | Appliance | Network |
|---|---|---|
| Versa’s WAN-edge appliance family – branch SD-WAN, firewall, and routing – that pairs with CSX switches at the LAN edge. | The general VOS device class a CSX belongs to; Analytics dashboards refer to appliances like a CSX as sites. | The VOS configuration object that groups a CSX’s interfaces for management; each interface belongs to exactly one network. |