What is a Headend?

A headend is the centralized management and control layer of a Versa SD-WAN deployment – a Versa Director, a Versa Analytics cluster, and one or more Versa Controller nodes, optionally paired with the Concerto orchestrator – typically hosted in a data center or public cloud and used to configure, control, and monitor branch and hub VOS devices.

Key takeaways

• A headend is the Director, Analytics, and Controller layer of Versa SD-WAN.
• It can deploy bare-metal or virtualized, on ESXi, KVM, AWS, Azure, or GCP.
• Northbound traffic reaches Director and Analytics; southbound reaches Controllers.
• Geographic redundancy pairs headend components across two data centers.
• Concerto can migrate a VOS appliance from one headend to another.

On this page: Why it matters · How it works · Types · Headends & Versa · FAQ

Why are headends important?

Every branch and hub in a Versa SD-WAN network needs somewhere to get its configuration, establish its control-plane sessions, and send its logs. The headend is that somewhere: a consolidated place from which administrators push policy, Controller nodes terminate the IPsec tunnels and MP-BGP sessions that hold the overlay together, and Analytics collects the telemetry that populates dashboards and reports. Without a centralized headend, each branch would be an island – configured by hand, invisible to network-wide monitoring, with no consistent point of control.

Because so much depends on it, headend design carries real weight. A poorly designed headend is a single point of failure for an entire SD-WAN fabric, so production deployments build in geographic redundancy, separate management (northbound) and control (southbound) traffic paths, and harden every component against compromise. Getting the architecture right before appliances onboard against it is a prerequisite for a stable network, not an afterthought.

What is a headend?

A headend’s three core components each do distinct work. Versa Director stores and pushes configuration and exposes the GUI and REST APIs administrators and OSS systems use. Versa Analytics – split into Analytics-personality and Search-personality nodes – collects logs and telemetry from VOS devices and drives dashboards, reports, and log search. Versa Controller nodes provide the control plane, terminating branch IPsec tunnels and MP-BGP sessions and, in hierarchical designs, coordinating with hub-controller nodes across isolated regions. Where Concerto is deployed, it orchestrates one or more headends as a fabric, discovering their Directors and Controllers and managing tenants across them.

Traffic to the headend splits into two segments: a northbound segment for management traffic – administrator and OSS access to Director and Analytics, and Director-to-Director HA synchronization – and a southbound segment carrying control traffic between Controllers and the SD-WAN overlay.

Types of headend deployments

Headend components can run bare-metal, directly on host OS hardware, or virtualized on ESXi, KVM, or the AWS, Azure, and Google Cloud Platform public clouds; bare-metal typically delivers 20-30% better performance but comes with hardware dependencies, since not every server platform – special RAID controllers, for instance – is supported. Topology is another axis: a single-data-center headend uses flat Layer 2 LANs with VRRP for gateway redundancy but cannot enforce Layer 3 security zones without adding firewalls in bridge mode, while a geographically redundant headend splits components across two data centers connected by service VNF routers. Concerto-managed fleets also distinguish headends by role – a pre-production headend for staging a VOS appliance’s configuration, and a production headend the appliance is later migrated onto.

Headends & Versa

Concerto treats the Director, Controller, and Analytics trio as the DCA Complex it coordinates, discovering each headend’s components and, for brownfield tenants configured directly on Director before Concerto existed, surfacing them in a disabled state until an administrator enables them. Concerto can also migrate an onboarded VOS appliance from one headend to another – exporting the site’s CSV, repointing its Director field, and republishing the appliance’s bind-data variables against the new headend’s Director. The design guide’s hardening recommendations apply to every headend regardless of topology: synchronized DNS and NTP across all nodes, a common time zone for log correlation, signed SSL certificates and password hardening, and the latest Director and OS security packs. See the Consolidated SD-WAN Design Guide for the full headend design guidelines and Migrating VOS Appliances Between Headends for the Concerto migration workflow.

Frequently asked questions

What components make up a Versa headend?

A Versa headend consists of a Versa Director, a Versa Analytics cluster, and one or more Versa Controller nodes, optionally coordinated by the Concerto orchestrator. Together these are sometimes called the DCA Complex – Director, Controller, Analytics – and they are usually hosted in a data center or public cloud rather than at a branch site.

What is the difference between a headend and a branch?

The headend is the centralized management and control layer, typically hosted in a data center or cloud. A branch is a remote site running a VOS device that connects to the headend for configuration, control-plane sessions, and log delivery, and that can also route traffic directly to other branches, the cloud, or a data center depending on its topology.

Can a Versa deployment have more than one headend?

Yes. Larger or multi-region fabrics run several headends, and Concerto can discover and coordinate more than one at once – including distinguishing a pre-production headend used for staging from the production headend an appliance is later migrated onto, once its configuration has been validated and its bind-data variables republished.

Should a headend be deployed bare-metal or virtualized?

Either is supported. Bare-metal typically delivers 20-30% better performance and scalability but introduces hardware dependencies, since not all server hardware is supported. Virtualized deployments on ESXi, KVM, or a public cloud such as AWS, Azure, or Google Cloud Platform trade some raw performance for deployment flexibility and easier scaling.

What is the DCA Complex?

DCA Complex is the collective term for Versa Director, Versa Controller, and Versa Analytics – the three components that make up a headend and that Concerto coordinates to configure, control, and monitor VOS devices across the branches and hubs in a deployment.

More on headend architecture

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about headends, these are worth looking at next.