Glossary

Number

24×7 Return to Factory (RTF): An optional hardware support coverage that extends beyond the standard two-year warranty, returning repaired or replaced CSG hardware to the customer within four weeks. See: Hardware Support Overview
802.1X: An IEEE standard for port-based network access control in which a switch authenticates connecting devices, typically against an external RADIUS server, before granting LAN or Wi-Fi access; Versa LAN profiles also use it for dynamic VLAN assignment. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Versa Titan Release Notes for Release 10.0, 10.1.2, and 10.2.2

A

Access Circuit: A WAN link, also called a circuit, on a VOS branch device, over which SD-WAN traffic is sent and per-link SLA metrics, bandwidth, and class-of-service statistics are measured; access circuits are the building blocks of paths, which run end-to-end between a local and a remote circuit. See: Analytics Log Collector Log Types Overview , SD-WAN Dashboards
Access Concentrator (AC): The server-side endpoint of a PPPoE connection that a PPPoE client interface contacts to initiate a session; the access concentrator confirms the connection and issues a session ID to the client. See: Configure PPPoE Interfaces in Concerto
Access Control List (ACL): A named, ordered set of rules that define match conditions on Layer 2 through Layer 7 criteria and apply an action, such as allow, deny, or reject, to matching traffic. See: Configure NPU Policy-Based Forwarding , Configure SD-LAN Using Workflow Templates (Release 22.1.3)
Access Control Policy: A tenant-scoped security policy consisting of an ordered set of rules that filter traffic by application, URL, user, address, zone, and service, applying an enforcement action such as Allow, Deny, or Reject, or a security enforcement profile. See: Configure SD-WAN Access Control Policies , Configure SD-WAN Security Access Control Policies and Rules
Access Point Name (APN): An identifier, provided by a cellular service provider, that an LTE, 4G, 5G, or WWAN interface uses to establish a data connection between the carrier's network and the internet or a private network. See: Configure CSM Interfaces , Configure WAN Interfaces in Concerto
Access Port: A Layer 2 interface mode used for ports that link to end devices; an access port belongs to a single VLAN (the access VLAN), treats untagged incoming packets as tagged with that VLAN's ID, and discards tagged frames whose VLAN ID does not match. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure Access and Trunk Interfaces in Concerto
Access Rule: A Versa Director rule, configured at the system or tenant level and evaluated top to bottom, that allows or denies client-subnet traffic reaching Versa Director based on username or role. See: Configure Access Rules on Versa Director
Active Collector: The destination or destinations currently receiving exported logs from a Log Export Functionality (LEF) profile; a profile can designate up to two active collectors. See: Apply Log Export Functionality
Active Optical Cable (AOC): A fiber-optic cable assembly with optical transceivers permanently attached at each end, used to connect SFP+, SFP28, or QSFP28 ports on Versa appliances at 10-, 25-, or 100-Gigabit Ethernet speeds without separate pluggable optics. See: CSX4000 Series Hardware Guide , Validated SFPs and Cables for CSX8000 Series Appliances
Active-Active: A high-availability deployment mode in which multiple instances concurrently process traffic, rather than one instance remaining idle as a passive standby. See: VOS High Availability in AWS Using Gateway Load Balancer
Adaptive Shaping: An SD-WAN congestion-management feature in which a hub device monitors its WAN-link utilization and dynamically signals connected branches to throttle their egress traffic rate, preventing hub-side congestion without manual reconfiguration as branches are added. See: Configure Adaptive Shaping , Configure WAN Interfaces in Concerto
Address Group: A reusable object that groups IP subnets, ranges, wildcard IPs, FQDNs, address objects, or other address groups, used as Layer 3 source and destination match criteria so policy can be applied collectively rather than per address. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
Address Object: A reusable policy object that defines a single address match value, such as an IPv4 or IPv6 subnet, range, wildcard, dynamic address list, or FQDN, for use as source or destination match criteria in security and traffic policies. See: Configure Address Objects , Configure Reusable Objects
Address Resolution Protocol (ARP): A protocol that maps a device's IP address to its hardware MAC address. Versa Director can display a network's ARP entries, including interface name, MAC address, and hardware type. See: Monitor VOS Device Networking Services
Administrative Distance: A per-protocol preference value, also called route preference, used to select the active route when multiple protocols learn the same prefix; the lowest value wins, with VOS defaults such as 0 for connected routes, 1 for static, 20 for EBGP, and 200 for IBGP. See: Configure Virtual Routers , Troubleshoot Routing Protocols
ADSL2+: An asymmetric digital subscriber line standard that provides a WAN interface between customer premises equipment and a DSL access multiplexer, supported on CSG NIC modules in Annex A or Annex B variants. See: Network Interface Cards , Network Interface Cards
Advanced Encryption Standard (AES): A symmetric encryption algorithm used across Versa products to protect data in transit, including IPsec tunnel encryption in CBC and GCM modes. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure the Versa Secure Access Service
Advanced Message Queuing Protocol (AMQP): An open standard messaging protocol, featuring message orientation, queuing, routing, and reliability, that Versa Director uses to publish event and object-change notifications to a connected message broker over TCP port 5672. See: AMQP Event Notifications , AMQP Object Change Notifications
Advanced Threat Protection (ATP): A multi-layered threat-detection capability that combines multiple antivirus engines, cloud lookup, file metadata analysis, multi-sandbox dynamic analysis, and AI/ML behavioral analysis to identify sophisticated and zero-day malware, applying actions such as allow, alert, block, reject, or quarantine. See: Best Practices for CASB Security , Security
Aggregated Ethernet Interface (AE): A logical interface, based on IEEE 802.3ad, that bundles two or more physical Ethernet interfaces using LACP or static bundling to increase throughput and provide redundancy if a member link fails. See: Configure Aggregated Ethernet Interfaces in Concerto , Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)
Always On: A Versa SASE client setting that automatically establishes and maintains the tunnel to the SASE gateway and prevents users from manually disconnecting it; combined with fail-close behavior, it blocks traffic when the connection is down. See: Configure Always On , Concerto SASE End-to-End Configuration
Analytics Aggregator: An Analytics cluster of aggregator nodes that combines tenant analytics data distributed across multiple, separately deployed Analytics clusters to provide a single consolidated view, with request load balancing and redundancy across its nodes. See: Hardware and Software Requirements for Headend , Configure Concerto Infrastructure Lifecycle
Analytics Aggregator Node: An Analytics node, available from Release 22.1.1, that consolidates and aggregates tenant, device, and resource data from multiple standard (child) Analytics clusters so reports can be built and viewed from a single node. See: Configure Analytics Aggregator Nodes , Manage Custom Reports
Analytics Application: The software interface running on every node in an Analytics cluster that lets administrators configure nodes, generate reports, and view dashboards; it is accessed through the Analytics tab of the Director GUI using Director login credentials. See: Monitor Analytics Clusters , Manage Analytics Synchronization
Analytics Cluster: A set of Versa Analytics nodes, specialized in roles such as analytics, search, or log forwarder, that receive logs exported from VOS devices, store them in database and search-engine datastores, and serve dashboards and reports to Versa Director. See: Overview of Analytics Troubleshooting , Overview of Analytics Dashboards, Insights, Log Screens, and Reports
Analytics Datastore: The searchable log store and analysis database maintained by an Analytics cluster's search-type and analytics-type nodes. Dashboards, log screens, and reports display only the data currently retained in these datastores. See: Overview of Analytics Dashboards, Insights, Log Screens, and Reports , Overview of Analytics Troubleshooting
Analytics Driver: The Versa Analytics process that performs extract, transform, and load operations on raw log files, converting them into records stored in the cluster's database and search-engine datastores. See: Monitor Analytics Clusters , Manage Versa Analytics Log Archives
Analytics Lite (VAN Lite): A lightweight Versa Analytics software image for small four-core, 4 GB RAM devices that receives logs from VOS controllers and streams them to third-party collectors, without full database or Analytics-cluster capabilities. See: Versa Software Types
Analytics Log Collector Node: Any Analytics node configured with at least one local collector to accept incoming Log Export Functionality (LEF) connections from VOS devices; it can be an analytics-type, search-type, forwarder-type, or lightweight-type node. See: Versa Analytics Configuration Concepts , Troubleshoot Log Processing and Archiving Issues
Analytics Node: One of the three Versa Analytics node personalities (analytics, search, forwarder) and one of its two database (datastore) personalities; it stores aggregated data and populates most dashboard views by default, without requiring additional logging configuration on VOS edge devices. See: Versa SD-WAN Design Guide
Anomaly Detection: An intrusion-detection method that compares observed network events against a baseline of normal traffic to identify unusual patterns, useful for detecting new or previously unseen attacks. See: Configure SD-WAN IPS Profiles , Configure SD-WAN IPS-Filtering Policies
Antivirus (AV): Malware detection and blocking applied to files in transit. Versa NGFW and Advanced Threat Protection provide antivirus scanning profiles as part of security policy. See: Configure Antivirus , Configure Antivirus (NGFW)
Antivirus Profile: A VOS configuration object that defines which traffic to inspect for viruses and what mitigation action to take; it is associated with an NGFW policy rule and applied to all matching traffic. See: Configuring and verifying Anti-Virus Profile
Anycast: An addressing and routing method in which the same IP address is advertised from multiple locations, so traffic is routed to the nearest instance; Versa SD-WAN deployments use it for services such as distributed DNS and default gateways. See: Anycast Proximity Deployment , Configure a Distributed Anycast Gateway
API-Based Data Protection (API-DP): A Versa capability that secures SaaS and IaaS applications by connecting to their cloud APIs, rather than intercepting traffic inline, scanning data at rest and in motion and enforcing actions such as redaction, encryption, quarantine, or deletion. See: Best Practices for CASB Security , Configure SASE Tenants
Appliance: A physical or virtual VOS device deployed as a branch, hub, gateway, or Controller node; Analytics reports and dashboards commonly refer to appliances as sites. See: Manage Custom Reports , SD-WAN Dashboards
Application Category: A reusable object that filters the application catalog by attributes such as risk level, productivity level, tags, and family or subfamily, producing a dynamic set of matching applications for use in policy rules. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
Application Delivery Controller (ADC): A load-balancing service that distributes traffic to backend servers behind a virtual service; on Versa Controller nodes it distributes LEF connections from VOS devices across log collector nodes, using default and backup server pools for redundancy. See: Configure a Secondary Cluster for Log Collection , Configure the Versa Advanced Logging Service
Application Detection: A capability that runs continuously on VOS devices, inspecting the first packet of a flow and maintaining a cache of IP addresses, applications, and URL categories, so traffic-steering and security policy can be applied from a flow's first packet. See: Configure SD-WAN Policy , Configure SD-WAN Traffic Steering
Application Group: A reusable object that combines one or more user-defined and predefined applications so they can be matched together as a set in a single policy rule. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
Application Identification (App-ID): The process of determining the application generating a session using signatures, heuristics, deep packet inspection, and statistical methods rather than relying solely on port or protocol, enabling policy control over evasive applications. See: Best Practices for Next-Gen Firewall as a Service (NGFWaaS) , Configure Next-Gen Firewall
Application Identification Library (AIL): A database, delivered as part of VOS and updated through SPacks, containing signatures used to detect and identify thousands of applications for use as match criteria in firewall, QoS, and SD-WAN traffic-steering policies. See: Why is Upgrading Versa AIL ProtoBundle Important? , Use Security Packages (SPacks)
Application Layer Gateway (ALG): A protocol-aware mechanism that inspects and translates traffic for protocols that embed connection information in their payload, such as FTP, SIP, TFTP, and PPTP, dynamically opening firewall pinholes so these protocols keep working across NAT and firewall boundaries. See: Configure ALG , Configure Application Layer Gateway
Application Monitor: A Concerto profile element that actively and continuously probes an IP address or FQDN using DNS, HTTP, HTTPS, ICMP, or TCP packets to determine whether the target is up or down and report on traffic. See: Configure Application Monitoring in Concerto
Application Object: A VOS custom object that defines an application's family, subfamily, risk level, productivity level, tags, and session timeout, used for application-based matching in NGFW security policy rules. See: Configure Next-Gen Firewall , Configure Next-Gen Firewall (NGFW)
Application Performance Monitoring (APM): Monitoring of application-level metrics such as connection setup time, response time, retransmissions, and round-trip time; Versa distinguishes passive APM, based on observed TCP traffic, from active APM, based on synthetic SaaS application tests. See: Passive Application Performance Monitoring Logs , SD-WAN Dashboards
Application QoS (AppQoS): A per-session VOS QoS policy type that classifies traffic using Layer 3 through Layer 7 criteria, including applications and URL categories, and assigns a forwarding class and loss priority; it is evaluated after standard QoS policy and can override its forwarding class. See: Consolidated SD-WAN Design Guide , SD-WAN Solution Architecture
Application Reverse Proxy: A Versa gateway service that publishes SaaS and private applications for clientless, browser-based access from unmanaged devices, enforcing ZTNA, SWG, CASB, and DLP policy and authenticating users through a SAML identity provider. See: Configure Application Reverse Proxy , Configure Application Reverse Proxy
Application-Steering Template: A Versa Director workflow template that automates business-intent traffic steering by grouping applications into traffic categories, or buckets, such as Real Time and Business Critical, each combining classification, QoS forwarding-class mapping, and circuit-selection rules. See: Consolidated SD-WAN Design Guide , SD-WAN Traffic Optimization
AS Path: A BGP path attribute listing the sequence of autonomous systems a route has traversed; routers use it for loop detection and can prepend AS numbers to it to make a route less preferred to peers. See: Configure BGP , Configure BGP Import and Export Rules
Assertion Consumer Service (ACS): The service-provider endpoint that receives and validates SAML assertions from an identity provider during single sign-on; after a successful login, the identity provider redirects the user's browser to the ACS URL with the authentication response. See: Configure Application Reverse Proxy , Configure Clientless Applications in Concerto
Audit Log: A record of administrative activity on Versa platforms, including configuration changes, logins and logouts, and UI and API actions, capturing the time, actor, and details of each action. See: Manage Users , Audit Logs
Authentication Profile: A Versa configuration object that defines how users are authenticated, including the authentication method or methods, caching mode, and cache and cookie expiration; it is referenced by authentication policy rules or attached to a Secure Access portal or gateway. See: Configure User and Group Policy , Configure User and Group Policy (NGFW)
Authentication, Authorization, and Accounting (AAA): A security framework that verifies user or device identity (authentication), determines what authenticated users are permitted to do (authorization), and records usage information such as login times and executed commands (accounting). See: Configure AAA , Configure SASE for SIM
Automatic Certificate Management Environment (ACME): A protocol that automates certificate issuance, enrollment, and renewal between a device and a certificate authority server, supported as a certificate server type on Versa devices running Release 22.1.3 and later. See: Configure a Secure SD-WAN Tenant , Configure Certificate Servers
Autonomous System (AS): A collection of IP networks and routers under a single administrative authority, identified by an AS number, that BGP uses as the basic unit for exchanging routing information and preventing routing loops. See: Configure BGP , Configure BGP Import and Export Rules
Autonomous System Number (ASN): The number that identifies an autonomous system in BGP routing; it is configured on VOS devices as the local and peer AS when establishing BGP sessions. See: Versa Networks SASE Gateway Integration with AWS Cloud , Versa Secure SD-WAN Integration with Versa SSE

B

Backup Designated Router (BDR): On a broadcast or multiaccess OSPF network, the router elected with the second-highest priority, ready to take over the designated router role if the DR fails. See: Configure Virtual Routers , Troubleshooting OSPF Neighbor Adjacency
Base Distinguished Name (Base DN): The starting point in an LDAP directory tree from which a search begins, defining the organizational scope of the query; Versa LDAP authentication profiles use it to limit where user and group lookups occur. See: Configuring Authentication Profiles on the SSE Gateway , Step-By-Step Configuration Guide for Versa Secure Internet Access (VSIA)
Best Gateway Selection: A Versa SASE client capability that automatically selects the optimal gateway within a gateway group based on the client's proximity to each gateway and the gateway's CPU load, memory load, and round-trip time. See: Concerto SASE End-to-End Configuration , Configure SASE Client to Select the Best Gateway Using Concerto
BGP Community: A BGP path attribute that tags a group of routes sharing a common property so they can be identified, matched, and acted on collectively in routing policy; well-known communities include no_advertise and no_export. See: Configure Virtual Routers , Different SD-WAN Tenants Peering over Shared LAN
BGP Local Preference: A BGP path-selection attribute that Versa SD-WAN designs manipulate, often together with BGP communities, to influence which data-center or hub appliance a branch site selects as its primary versus secondary path. See: Horizontal Scale-Out of Versa SD-WAN Appliance at DC/Hub Site
BGP Peer Group: A named collection of BGP neighbors that share common configuration, such as AS number, timers, and policies, letting multiple peers be configured together and one set of update messages be replicated across the group. See: VOS Edge Routing Protocols , Dynamic Protocol Configuration – BGP
BGP Peer Policy: A policy made up of ordered match-and-action terms that filter or modify BGP routes received from, or advertised to, remote BGP peers, matching on criteria such as community, AS path, or prefix. See: Configure BGP Import and Export Rules , Configure Reusable Objects
Bidirectional Forwarding Detection (BFD): A lightweight protocol that detects link or path failures between neighbors in milliseconds, letting BGP, OSPF, RIP, and static routes converge faster than their native dead timers allow. See: Networking , Monitor VOS Device Networking Services
Bind Data: Device-specific variable values, such as static IP addresses or VLAN IDs, that fill in the parameterized fields of a device or service template when a device is deployed; not required for fields where DHCP is enabled. See: Configure Basic Features
Bind Distinguished Name (Bind DN): The distinguished name of the service account an LDAP client uses to authenticate to and query a directory server; Versa uses the Bind DN and its password to search the directory for users and groups during LDAP authentication. See: Configuring Authentication Profiles on the SSE Gateway , Step-By-Step Configuration Guide for Versa Secure Internet Access (VSIA)
Bind Variable: A placeholder value in a Concerto profile or Versa Director template that is resolved per device at deployment time, letting a single template supply device-specific values such as IP addresses, including for the members of an HA pair. See: Director GUI Overview , Director GUI Overview (for Releases 21.2 and Earlier)
BIOS: The firmware layer on Versa CSG appliances that operates independently of VOS, Director credentials, and operating-system authentication, and is accessible to anyone with physical or serial console access unless protected by a BIOS password. See: Set the BIOS Password on CSG Platforms
Bootstrap Router (BSR): A router elected within a PIM domain that collects candidate rendezvous point advertisements and announces the selected set of RPs to all routers through a bootstrap message, avoiding static rendezvous point configuration. See: Multicast , Configure IP Multicast
Border Gateway Protocol (BGP): A path-vector routing protocol used to exchange reachability information between autonomous systems; Versa SD-WAN uses it between CPE devices, Controllers, and LAN- or cloud-side routers, with attributes such as local preference and AS path influencing path selection. See: Networking , View Concerto SD-WAN Dashboards
Bottleneck Bandwidth and Round-Trip Propagation Time (BBR): A TCP congestion-control algorithm that measures a connection's largest recent available bandwidth and smallest recent round-trip delay to control how fast and how much data it sends; it is the default WAN-side algorithm in Versa TCP optimization profiles. See: Configure Profile Elements , Configure SD-WAN Traffic Steering
Branch: A site in a Versa SD-WAN network, running a VOS device, that connects to the headend over the internet or a private network such as MPLS and can route traffic directly to other branches, the cloud, or a data center, depending on policy. See: Headend Overview , Hardware and Software Requirements for Headend
Branch Staging: The sequence of provisioning states (prestaging, staging, and post-staging) that a VOS branch appliance progresses through during onboarding; pressing the appliance's Reset button a set number of times returns it to one of these states or to the factory-default snapshot. See: CSG700 Series Hardware Guide , CSX2000 Series Hardware Guide
Breakout Cable: A cable, either AOC or DAC, that splits one higher-speed QSFP+ or QSFP28 port into four lower-speed SFP+ or SFP28 connections on Versa CSG and CSX appliances. See: Validated SFPs and Cables for CSX8000 Series Appliances , Validated SFPs and Cables for CSG3000 Series Appliances
Bridge Domain: A set of logical interfaces on a virtual switch that share the same Layer 2 broadcast domain, each associated with a VLAN ID and maintaining its own MAC learning and forwarding table; in VXLAN deployments it also maps to a VXLAN network identifier. See: Configure EVPN VXLAN for ZT-LAN , Configure SD-LAN Using Workflow Templates (Release 22.1.3)
Bring Your Own Device (BYOD): A practice in which employees use personally owned devices, rather than corporate-issued hardware, to access enterprise resources, posing additional security risks that context-aware, posture-based access policies are designed to mitigate. See: Device Fingerprinting for Zero Trust Access , Enforce OS-Based Secure Access Policy Rules for Remote SASE Clients
BUM Traffic (BUM): Broadcast, unknown-unicast, and multicast traffic, the Layer 2 traffic types that must be flooded throughout a bridge domain. EVPN networks control BUM traffic with designated-forwarder election and split-horizon filtering, and storm control rate-limits it to prevent traffic storms. See: Configure EVPN Multihoming for Hosts Using ZT-LAN , Configure EVPN VXLAN for ZT-LAN

C

CA Chain: An ordered list of CA certificates, including all intermediate certificate authorities up to the root CA, used to validate a device or gateway certificate back to a trusted root during authentication. See: Upload Custom CA Certificate, Key File, and CA Chain , Configure SD-WAN Certificates
Canonical Name Record (CNAME): A DNS record type that aliases one domain name to another; search engines provide CNAME endpoints that networks can use to force safe-search enforcement. See: Configure Safe Search
Captive Portal: A webpage to which a user's web traffic is redirected to require authentication or to display informational, justification, or PIN-override messages before network or internet access is granted or denied; it is the recommended fallback for non-domain-joined or BYOD devices. See: Enable and Configure VMS Services , Configure EIP-Based Microsegmentation for SD-LAN
Carrier-Grade NAT (CGNAT): Large-scale network address and port translation that shares a pool of public IP addresses among many subscribers; on VOS devices, CGNAT pools and rules translate traffic for internet breakout, network obfuscation, and combined source and destination (twice-NAT) scenarios. See: Analytics Log Collector Log Types Overview , Analytics Log Screens by Title
Central Breakout (CBO): A WAN architecture in which branch-originated internet traffic is backhauled through a central site, such as a data center or headquarters, for egress and security inspection before reaching the internet. See: Configure DNS Proxy with SD-WAN Traffic Steering for DIA , Versa Secure SD-WAN Integration with Versa SSE
Certificate Authority (CA): A trusted entity that issues and signs digital certificates verifying the identity of a device or entity on a network; VOS devices can secure traffic using a self-signed CA certificate or one issued by a trusted third-party CA. See: Configure a Secure SD-WAN Tenant , Deploy an SSE Gateway and Onboard Tenants Using Concerto
Certificate Chain: An ordered list of certificates, comprising an SSL/TLS certificate together with one or more CA certificates, that lets a receiver verify that the sender and every issuing certificate authority in the chain are trustworthy. See: Configure CA Certificates, Key File, and CA Chains , Configure Captive Portal for SD-WAN
Certificate Management Protocol (CMP): A protocol that a certificate authority server can use for certificate enrollment, selectable alongside ACME and SCEP as a server type when configuring a certificate authority on Versa devices. See: Configure a Secure SD-WAN Tenant , Configure Certificate Servers
Certificate Pinning: A technique in which a client application trusts only a specific server certificate or public key rather than relying solely on certificate-authority trust, preventing man-in-the-middle TLS decryption and inline inspection of that application's traffic. See: Best Practices for CASB Security , Decryption Bypass for Certificate Pinned Applications
Certificate Revocation List (CRL): A list, published by a certificate authority, of certificates revoked before their expiration date; VOS devices can check the CRL as an alternative or complement to OCSP, with which it shares a status cache. See: Configure Certificate Servers , Configure a Common Certificate Authority
Certificate Signing Request (CSR): A file generated by a client or device, containing its public key and identifying information such as common name and subject alternative names, that is submitted to a certificate authority to obtain a signed digital certificate. See: Configure a Secure SD-WAN Tenant , Configure CSR Objects
Certificate-Based Authentication: A method of validating the identity of a user or device using a digital certificate rather than, or in addition to, a password, in which a gateway requests a client certificate during registration or connection. See: Configure Certificate-Based Authentication for SASE Clients , Configure Certificate-Based Device Authentication for Secure Access
Change of Authorization (CoA): A RADIUS extension that lets a server dynamically change the attributes or authorization state of an already-authenticated session, such as moving a user to a different segment, without requiring reauthentication. See: Configure CWA Redirect Authentication for SD-LAN , Configure IEEE 802.1X Device Authentication
CIDR: A notation for expressing an IP address together with its network prefix length, for example 172.16.4.0/25, used for specifying subnets and address ranges. See: Titan Mobile 9.3.0
Cipher Block Chaining (CBC): A block-cipher encryption mode in which each block is combined with the previous ciphertext block; it is available in VOS IPsec transforms, typically paired with a separate integrity hash. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure the Versa Secure Access Service
CIS Benchmark: A set of vendor-neutral, consensus-based security configuration guidelines published by the Center for Internet Security. Versa's secure-mode hardening aligns a device's Linux core OS components to CIS benchmarks. See: Perform Manual Hardening for Versa Analytics , Perform Manual Hardening for Versa Branches, Controllers, and Hubs
Class of Service (CoS): A traffic-prioritization mechanism, also called quality of service, that classifies ingress traffic into forwarding classes and schedules egress traffic so higher-priority traffic is handled preferentially during congestion; rewrite rules can change CoS markings on egress. See: SD-WAN Logs , Configure CoS for SD-LAN
Client Native Application: A user-defined application object for anything that must interact directly with the Versa SASE client or be referenced in a Secure Access rule, such as applications used for split tunneling or Digital Experience Monitoring, identified by FQDN or executable file path. See: Step-By-Step Configuration: Versa Secure Private Access (VSPA) , Step-By-Step Configuration Guide for
Clientless Access: A method of providing secure access to enterprise resources through a standard web browser, without installing client software on the end-user device; Concerto delivers it through Guacamole-based clientless access instances that also support non-HTTP applications. See: Concerto Home Screen Overview , Configure SASE Tenants
Cloud Access Security Broker (CASB): A security control point that provides visibility, policy enforcement, and compliance across cloud and SaaS applications, discovering shadow IT, monitoring user activity such as uploads, downloads, and shares, and enforcing risk-based access and data-loss-prevention policies. See: Best Practices for CASB Security , Security
Cloud Firewall: A Versa Networks firewall product offering. See: Introduction to Cloud Firewall
Cloud Gateway: A VOS SASE instance deployed natively into a public cloud network fabric, such as an Azure Virtual WAN hub, that is zero-touch provisioned by Versa Director to provide SD-WAN and security services to cloud-connected sites. See: Natively Integrate a VOS Cloud Gateway on an Azure Virtual WAN Hub
Cloud Lookup: A file-filtering and IoT security mechanism that sends a file's hash, or a device's identifying signature, to a cloud server to check its reputation or identity when no local rule or list entry matches, returning whether the item is clean, malicious, or suspicious. See: Configure File Filtering , Configure IoT Security
Cloud Profile: A profile that configures the connection used to look up file reputation or device identity on a cloud server, including the source NAT pool, connection pool size, timeout, and DNS redirection policy used to reach the server. See: Configure File Filtering , Configure IoT Security
Cloud Services Gateway (CSG): Versa Networks' family of physical branch and WAN-edge appliances, spanning models from the CSG150 through the CSG5000 series, that run the Versa Operating System to deliver SD-WAN, routing, and integrated security. See: Configure Hierarchical Scheduling , Configure EIP-Based Microsegmentation for SD-LAN
Cloud Services Modem (CSM): Versa Networks' family of 5G/LTE wireless WAN modem appliances that connect to a branch VOS device, typically powered over Ethernet, providing cellular WAN connectivity that can carry both direct internet access and SD-WAN overlay traffic. See: Configure CSM Interfaces , Cloud Services Modem 64 Series
Cloud Services Switch (CSX): Versa Networks' family of SD-LAN edge, access, aggregation, and core Ethernet switching appliances, including the CSX2000, CSX4000, and CSX8000 series, that combine an Ethernet switch chipset with an x86 processor subsystem running the Versa Operating System. See: Configure Hierarchical Scheduling , Configure EIP-Based Microsegmentation for SD-LAN
Cloud URL Lookup: A VOS capability that queries the Versa cloud database of roughly 2 billion categorized URLs, in synchronous or asynchronous mode, to determine the category and reputation of a URL not found in the device's local database. See: Approaches for URL Filtering , Configure DNS Filtering
Cloud Workload: An application, service, or capability that runs on a cloud device, or an amount of work consuming cloud-based resources such as compute or memory; Versa Director displays cloud workloads for devices with cloud workload protection enabled. See: Monitor the Cloud Workload
Cloud Workload Protection (CWP): A capability, enabled through a CMS connector, that secures workloads moving across cloud environments by having Versa Director fetch the tags and IP addresses of cloud resources for use in dynamic address groups. See: Install on Google Cloud Platform , Monitor the Cloud Workload
Cloud-init: An industry-standard, multidistribution method for cross-platform cloud instance initialization; VOS devices can use cloud-init to automatically apply configuration and ZTP staging parameters the first time they boot. See: Activate VOS Devices
CMS Connector: A Versa Director object that connects an organization to a cloud management system, such as an AWS, Azure, or Google Cloud Platform account, or to a third-party cloud service, so Director can deploy and manage VOS devices in that cloud or integrate the service. See: Configure a Public Cloud Device To Be a Virtual CPE Router or an SD-WAN Gateway , Configure Multitenancy
Collector Group: A list of one or more logging collectors within a logging profile, with one collector designated active per group; if the active collector becomes unreachable, another collector in the group takes over. See: Configure Reusable Objects
Committed Information Rate (CIR): The guaranteed bandwidth rate reserved for a traffic class or queue, honored even during congestion; traffic beyond the CIR is distributed among classes by priority or marked by a policer for potential dropping. See: Configure NPU Policy-Based Forwarding , Configure CoS for SD-LAN
Common Name (CN): The certificate subject field that traditionally carries the server host name or user identity; it is used when generating certificate signing requests and validating peer certificates. See: Configuring Authentication Profiles on the SSE Gateway , Step-By-Step Configuration:
Common Vulnerabilities and Exposures (CVE): A dictionary of publicly known information-security vulnerabilities, each identified by year and number, referenced by IDS/IPS signatures and vulnerability rules to identify specific threats. See: Configure SD-WAN IPS Profiles , Configure SD-WAN IPS-Filtering Policies
Common Vulnerability Scoring System (CVSS): An industry-standard system that rates the severity of a security vulnerability with a numeric score from 1 through 10; Versa vulnerability profiles use CVSS score ranges to select which signatures a rule matches. See: Configure SD-WAN IPS Profiles , Configure SD-WAN IPS-Filtering Policies
Containerized CSG (cCSG): A containerized software form factor of the Cloud Services Gateway that customers deploy on their own cloud server, offered in sizes such as L, M, XL, and 2XL for SD-WAN branch or SASE gateway roles. See: Portal for Titan Order Management for MSPs , Titan Portal 9.1.1
Control Virtual Router: A per-tenant virtual router on a VOS device that runs MP-BGP to exchange IPv4 VPN, IPv6 VPN, EVPN, and multicast routes with SD-WAN Controller nodes, which act as route reflectors. See: Understand SD-WAN Interface Numbering , Solution Use Cases
Controller: Also called the Versa Controller: a VOS device that provides the control-plane function in an SD-WAN overlay, terminating IPsec tunnels and MP-BGP sessions to branch VOS devices, and that manages switch devices in SD-LAN deployments; Controllers are typically deployed in redundant active-active pairs. See: Configure Basic Features , Upgrade Software on Headend and Branch
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP): The default Wi-Fi encryption protocol supported on Versa appliances for securing corporate and guest wireless networks. See: Use the Configure Dashboard
Cross-Connect Link: A physical connection between two paired VOS devices in a high-availability branch that logically extends each device's WAN transport to its peer; traffic arriving on a standby device is forwarded over this link to the active device for processing. See: Consolidated SD-WAN Design Guide , Branch Deployment Options
CSG1000 Series: A Cloud Services Gateway appliance family (models CSG1300 and CSG1500) for large enterprise branches, campus sites, and data centers, providing SD-WAN, routing, security, and uCPE capability with LTE and Wi-Fi module options. See: At a Glance Cloud Services Gateway 1000 Series , CSG1000 Series Appliance Specifications
CSG150 Series: A compact, fanless Cloud Services Gateway appliance for small branches, kiosks, ATMs, and home offices, with four Gigabit Ethernet ports, a PoE management port, and no field-replaceable parts, running VOS for SD-WAN, routing, and security. See: At a Glance Cloud Services Gateway 150 Series , Connect a CSG150 Series Appliance
CSG2500: A rack-mountable Cloud Services Gateway appliance for WAN-edge deployments in large regional offices, campus sites, and data centers, with eight 1-Gigabit and eight 1G/10G SFP+ Ethernet ports configurable as LAN or WAN interfaces and dual hot-swappable power supplies. See: At a Glance Cloud Services Gateway 2500 Series , Connect a CSG2500 Appliance
CSG300 Series: A Cloud Services Gateway appliance family (models CSG350, CSG355, and CSG365) for small and medium branches and home offices, providing site-to-site connectivity with optional LTE and Wi-Fi modules; the CSG355 and CSG365 also add NGFW and UTM security. See: At a Glance Cloud Services Gateway 300 Series , CSG300 Series Appliance Specifications
CSG3000 Series: A Cloud Services Gateway appliance family (models CSG3300 and CSG3500) offering line-rate Layer 2/Layer 3 switching alongside routing, SD-WAN, and integrated NGFW/UTM/ZTNA security for large branches, campuses, and data centers, with redundant hot-swappable power supplies and optional LTE modules. See: At a Glance Cloud Services Gateway 3000 Series , Install a CSG3000 Series Appliance
CSG5000 Series: A high-capacity Cloud Services Gateway appliance family (models CSG5000, CSG5200, and CSG5250) for large regional offices, campuses, and data centers, providing up to sixteen 10/25-Gigabit and six 100-Gigabit Ethernet ports with hardware-based class-of-service shaping for scalable SD-WAN and SASE services. See: At a Glance Cloud Services Gateway 5000 Series , Installation Guidelines
CSG700 Series: A fanless Cloud Services Gateway appliance family (models CSG730, CSG750, CSG770, CSG780R, and R-revision variants) delivering SD-WAN, NGFW/UTM/ZTNA security, and carrier-class routing for branch offices, with LTE/5G and Wi-Fi module options. See: At a Glance Cloud Services Gateway 700 Series , CSG700 Series Appliance Specifications
CSM64 Series: A Cloud Services Modem appliance line (models CSM64 for indoor and CSM64b for outdoor deployment) providing sub-6 GHz 5G cellular WAN connectivity with SIM slots and PoE power options, paired with a Versa SD-WAN appliance. See: Cloud Services Modem 64 Series
CSX2000 Series: A Cloud Services Switch appliance line (models CSX2200 and CSX2300) built as an SD-LAN edge and access-layer switch, combining PoE++ Ethernet switching with built-in x86 compute running VOS-based security and routing. See: At a Glance , Connect a CSX2000 Series Appliance
CSX4000 Series: A Cloud Services Switch appliance line (models CSX4300 and CSX4500) for the LAN edge and access layer in large branches, campuses, and data centers, with PoE++, 25/10-Gigabit and 100-Gigabit uplinks, and x86 compute for VOS routing, SD-WAN, and security services. See: Infrastructure , ZT-LAN Overview
CSX8000 Series: A Cloud Services Switch appliance line (models CSX8300 and CSX8500) for campus aggregation, core, and data-center deployments, offering 25/10-Gigabit and 100-Gigabit Ethernet interfaces with switching capacity up to 3.2 Tbps. See: ZT-LAN Overview , At a Glance Cloud Services Switch 8000 Series
Cubic Congestion Control: A TCP congestion-control algorithm that uses a cubic function, rather than a linear window-increase function, to improve scalability and stability on fast, long-distance networks; it is the default LAN-side algorithm in Versa TCP optimization profiles. See: Configure SD-WAN Traffic Steering , Configure Profile Elements
Custom Application: A per-tenant application object, defined by attributes such as host pattern, protocol, and source or destination ports, that becomes available across devices for use in policy configuration once published. See: Manage Organization Settings
Custom Signatures: User-uploaded intrusion prevention system signature files, in.zip or.rules format, that are published to and automatically activated on all SASE gateways where the tenant is present, extending detection beyond the built-in signature set. See: Configure Custom Signatures
Custom URL Category: A per-tenant object that groups URLs matched by a string or regex pattern under a unique name and reputation value, usable as Layer 7 match criteria in SD-WAN and security policy rules. See: Manage Organization Settings
Customer Edge (CE): The customer-side router that connects a site to a provider network; in Versa deployments a VOS device often acts as the CE, peering with provider edge routers over BGP or in EVPN/VXLAN topologies. See: CSG300 Series Hardware Guide , CSG700 Series Hardware Guide
Customer Premises Equipment (CPE): Networking equipment installed at a customer site, such as a VOS branch appliance, that connects to a service provider's network to provide WAN connectivity and SD-WAN functionality. See: Troubleshoot Connectivity Issues , Troubleshoot – Versa Appliance to Analytics Connectivity Issue

D

Data Loss Prevention (DLP): A set of tools and processes for detecting and preventing the unauthorized transfer, exposure, or destruction of sensitive data, such as blocking specific file types or scanning files and traffic for policy violations. See: Best Practices for CASB Security , Security
Data Pattern: The most granular building block of Versa's DLP configuration, typically a keyword combined with a regular expression used to detect a specific sensitive value; a match requires both the keyword and the regex hit within a configurable byte range. See: DLP Configuration Guide
Data-Driven SLA Monitoring: An SD-WAN feature that creates and deletes SLA-monitoring contexts between branches based on whether data traffic is actively flowing, reducing SLA probe load in large full-mesh topologies and on high-cost links such as LTE. See: Configure Automatic Bandwidth Monitoring , Configure Data-Driven SLA Monitoring
Datagram Transport Layer Security (DTLS): A UDP-based variant of TLS that secures datagram communications; supported alongside IPsec and TLS as a tunnel type between the Versa SASE client and a gateway, and recommended over TLS to avoid TCP-over-TCP performance issues. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Concerto SASE End-to-End Configuration
Datastore: In Versa Analytics, the underlying storage — either the noSQL database table or the search-engine index — that holds processed log data used to build charts, tables, and log views in reports and dashboards. See: Manage Custom Reports , Monitor Analytics Clusters
DCA Complex: The collective term for Versa Director, Versa Controller, and Versa Analytics, the three headend components that the Concerto orchestrator coordinates to configure, control, and monitor VOS devices. See: Versa Concerto for SD-WAN , Headend Overview
Dead on Arrival (DOA): A hardware-support classification for a device that is non-functional out of the box or within 90 days of shipment, qualifying it for expedited replacement under the Versa Networks hardware warranty. See: Hardware Support Overview
Dead Peer Detection (DPD): An IKE mechanism that detects whether an IPsec peer is still reachable by sending a probe packet after a configured timeout with no traffic from the peer, triggering tunnel teardown or rebuild if the peer stops responding. See: Configure IPsec VPN Profiles , Configure Site-to-Site Tunnel Interfaces in Concerto
Deep Packet Inspection (DPI): A traffic-classification technique that examines packet contents beyond the header, matching application signatures to identify the application generating a session; VOS uses DPI to automatically recognize more than 3,000 applications. See: Core Platforms , Security
Denial of Service (DoS): An attack that attempts to disrupt network services and deny access to legitimate users by overwhelming a target with unnecessary traffic from one or more sources, exhausting its hardware and software resources. See: DoS Protection Logs , Analytics Log Collector Log Types Overview
Designated Forwarder (DF): In an EVPN multihomed topology, the device responsible for forwarding broadcast, unknown-unicast, and multicast (BUM) traffic to and from a multihomed host; a backup, non-designated forwarder takes over if it fails. See: Configure EVPN Multihoming for Hosts Using ZT-LAN , Configure EVPN VXLAN for ZT-LAN
Designated Router (DR): In OSPF, the router elected on a multi-access network to originate network advertisements and reduce adjacency overhead; VOS interface settings control DR election priority. See: Configure IP Multicast , Configure SD-WAN Topology and LAN Routing Protocols
Destination NAT (DNAT): A NAT method that translates the destination IP address, and optionally the destination port, of inbound traffic, performing the inverse translation on replies; commonly used to expose a privately addressed internal server to the public internet. See: Configure CGNAT , Configure CGNAT Policies
Device Bind Data: The unique, per-device values, entered through a form generated from a device template's variables, that combine with the device template to produce an individual device's configuration. See: Overview of Configuration Templates
Device Certificate Authentication: An authentication method that validates an endpoint device's identity using a digital certificate checked against a trusted CA chain before granting access, optionally with OCSP verification, and combinable with user authentication for layered verification. See: Step-By-Step Configuration: , Step-By-Step Configuration: Versa Secure Private Access (VSPA)
Device Fingerprinting: A technique that identifies an endpoint from collected attributes such as model, vendor, OS version, serial number, and MAC address; VOS uses it to identify headless IoT devices that cannot run the SASE client for microsegmentation and posture-based access decisions. See: Configure Microsegmentation , Device Fingerprinting for Zero Trust Access
Device Group: A collection of devices in a Versa Director organization that share the same device template and, optionally, service templates, used for bind-data management and applying consistent configuration to multiple devices at once. See: Configure a Public Cloud Device To Be a Virtual CPE Router or an SD-WAN Gateway , Bind Parameterized Variables to Values for a Post-Staging Template
Device IP Address Reservation: A Titan LAN feature that permanently assigns a specific IP address to a device's MAC address within the DHCP pool, so the device always receives the same address. See: Titan Portal 8.1.0 , Titan Mobile 9.1.0
Device Risk Score (DRS): A Versa Advanced Security Cloud service that computes an endpoint's risk score from unified entity risk profile inputs and distributes it, via the advanced VMS connector, to SASE gateways for use in dynamic, risk-based access policies. See: Configure VMS to Integrate EDR Platforms , Configure ASC Worker Nodes and Deploy Versa Secure Lens
Device Template: A baseline configuration in Versa Director, also called a post-staging template, that can be deployed across many branches to save time configuring similar services; device templates exist as staging templates for testing and post-staging templates for production. See: Director GUI Overview , Overview of Configuration Templates
DHCP Options Profile: A configuration profile that defines the DHCP options, such as default router, DNS servers, and vendor-specific options, that a DHCP server sends to clients when allocating addresses. See: Configure DHCP
DHCP Relay: A function that forwards DHCP messages between clients and one or more remote DHCP servers when they are located in different subnets, supporting multiple forwarder addresses for redundancy. See: Configure VRRP and DHCP Relay on LAN Interfaces in Concerto , Configure DHCP
DHCP Snooping: A Layer 2 security feature that inspects DHCP messages from untrusted hosts, builds a trusted table binding IP addresses to MAC addresses, and blocks unauthorized DHCP servers; on VOS devices it is a prerequisite for IP source guard. See: Configure DHCP Snooping , Configure IP Source Guard
Differentiated Services (DiffServ): A quality-of-service architecture that classifies and manages network traffic through per-hop behaviors applied at each router, referenced in Versa's forwarding-class model for prioritizing packet handling. See: View Firewall Analytics
Differentiated Services Code Point (DSCP): A field in the IPv4 or IPv6 header that marks a packet's priority for QoS treatment; VOS devices use DSCP values as match criteria in classifier, policy, and rewrite rules and can remark them on ingress or egress. See: TWAMP Logs , Configure CoS for SD-LAN
Diffie-Hellman Group (DH Group): A numbered set of parameters, defined by modulus size or elliptic curve, that determines the cryptographic strength of the key exchange in IKE and IPsec negotiation; higher-numbered groups generally provide stronger keys, and Versa recommends DH Group 14. See: Configure Site-to-Site Tunnel Interfaces in Concerto , Use the Versa SASE Client Application
Digital Experience Monitoring (DEM): A Versa capability that periodically measures end-to-end network and application performance from the end user's perspective, across segments such as the device, Wi-Fi, LAN, WAN, and predefined applications, sending metrics to Versa Analytics for administrator visibility. See: Security , View Digital Experience Monitoring Dashboards
Digital Optical Monitoring (DOM): Real-time diagnostic parameters, such as transmit/receive power, temperature, voltage, and laser bias current, reported by an optical transceiver per the SFF-8472 specification; VOS can read and report them for SFP modules. See: Monitor the SFP Module
Digital Subscriber Line (DSL): A family of technologies for high-speed data transmission over copper telephone lines; VOS devices support ADSL2+ and VDSL2 through optional NIC modules on CSG appliances, with PPPoE, PPPoEoA, or VLAN encapsulation. See: Configure Interfaces , Network Interface Cards
Direct Cloud Access (DCA): A traffic-steering optimization that routes traffic destined for cloud applications directly from a branch to the cloud provider, similar in purpose to direct internet access but targeted at cloud-hosted applications and infrastructure. See: Install Concerto , View Concerto SD-WAN Dashboards
Direct Internet Access (DIA): A branch connectivity model in which internet-bound and SaaS traffic breaks out locally at the branch site instead of being backhauled to a central hub or data center, typically via a split tunnel with source NAT applied, reducing latency. See: Deploy an SSE Gateway and Onboard Tenants Using Concerto , Configure SASE Tenants
Direct-Attach Copper Cable (DAC): A passive copper twinax cable with integrated connectors at each end, used as a lower-cost, short-distance alternative to optical transceivers between SFP+, SFP28, or QSFP28 ports; breakout variants split a QSFP28 port into multiple lower-rate Ethernet ports. See: At a Glance Cloud Services Switch 8000 Series , CSX4000 Series Hardware Guide
Director Workflow: A guided, wizard-style mechanism in Versa Director that creates infrastructure objects and templates — organizations, controllers, device templates, device groups — from generalized input, automating complex SD-WAN configurations such as HA topologies, DIA breakout, and BGP peering. See: Overview of Configuration Templates , Consolidated SD-WAN Design Guide
Distinguished Name (DN): The unique hierarchical name identifying an entry in an LDAP directory or an X.509 certificate subject — for example the bind DN an appliance uses to authenticate to a directory server. See: Configuring Authentication Profiles on the SSE Gateway , Step-By-Step Configuration:
Distributed Anycast Gateway: An EVPN/VXLAN design in which multiple branches share the same default-gateway IP and MAC address, so a client's ARP entry stays valid and traffic is not lost when the client moves within the same VXLAN network. See: Configure a Distributed Anycast Gateway
Distributed Denial-of-Service (DDoS): A denial-of-service attack launched from multiple distributed sources simultaneously, overwhelming a target with traffic to exhaust resources or disrupt availability; Versa Analytics and Concerto security dashboards report detected DDoS threat statistics. See: Security Dashboards , View Security Analytics Data
DLP Profile: The top-level Versa DLP configuration object that groups one or more DLP rules, defines their evaluation order and a default action for unmatched traffic, and is referenced by a real-time protection policy to enforce data loss prevention. See: Getting Started with Versa Data Loss Prevention for Exact Data Match , DLP Configuration Guide
DLP Rule: A component of a DLP profile that defines matching criteria for sensitive content as a Boolean expression over data patterns or data protection profiles, along with the inspection method, file types, traffic context, and enforcement action. See: Getting Started with Versa Data Loss Prevention for Exact Data Match , DLP Configuration Guide
DNS Filtering: A security control that inspects DNS queries and responses and blocks resolution of domains associated with malware, phishing, or policy-prohibited categories, stopping sessions before any connection is established; actions can also key on query type, such as rejecting AAAA queries. See: Configure DNS Filtering , Configure DNS Filtering (NGFW)
DNS Proxy: A VOS function that intercepts client DNS requests and redirects them to selected DNS servers based on configured resolvers and policy, used to steer SaaS traffic to the best breakout, route private-domain queries internally, and hide server addresses via network obfuscation. See: Configure a DNS Proxy , VOS Edge Device Direct Internet Access
DNS Proxy Policy: A policy of redirection rules that match incoming DNS requests by source and destination address, zone, user, and DNS operation code, directing matching requests to a DNS proxy profile or a static IP address response. See: Configure DNS Proxy for Concerto (NGFW)
DNS Proxy Profile: A profile that defines the DNS resolvers used to resolve domain names in DNS requests, along with the interfaces and source NAT pools used to reach those resolvers; it is associated with redirection rules in a DNS proxy policy. See: Configure DNS Proxy for Concerto (NGFW)
DNS Resolver: A configuration object that specifies a domain name and DNS server IP address, shared with SASE clients at registration to determine which DNS server the client uses to look up that domain. See: Configure SASE Secure Client Access Profiles in Release 12.1.1 , Configure SASE Secure Client Access Routes and DNS Resolvers for Secure Client Access
DNS Sinkhole: A technique that returns a false IP address in response to a DNS query for a malicious or disallowed domain, preventing resolution and helping identify infected hosts that then attempt to reach the sinkhole address instead of their intended destination. See: Flow Logs , Configure Threat Intelligence from VMS
DNS Tunneling: A technique that encodes non-DNS data inside DNS queries and responses to create covert command-and-control channels or exfiltrate data; VOS detects DNS tunnels through frequency- and invalid-character-based analysis and logs the domain, detection type, reason, and client IP. See: Flow Logs , Configure SD-WAN DNS-Filtering Profiles
DNS-Filtering Profile: A profile that controls access to websites and IP addresses resolved through DNS, using deny/allow lists, query-based opcode actions, reputation-based actions for newly observed domains, and DNS-tunneling detection. See: Configure SD-WAN DNS-Filtering Profiles , Configure SD-WAN Access Control Policies
Document Fingerprinting: A DLP detection technique that converts a registered reference document into a sensitive-information signature and compares candidate files against it using a configurable similarity threshold, detecting when the document, excerpts, or filled-in copies of it leave the network. See: Manage Files and Folders , Configure Data Loss Prevention in Concerto
Domain Name System (DNS): The naming service that translates domain names into IP addresses; Versa Director nodes and VOS devices are configured with DNS name servers, search domains, and a local domain for hostname resolution. See: Configure DNS Settings , Configure Systemwide Functions
Domain VPN Tag: An OSPF Type 5 LSA tag, set to a VRF's instance number, that identifies routes redistributed from a BGP/MPLS VPN so a PE router with the same VRF instance number ignores its own re-advertised routes, preventing loops for external routes. See: Using OSPF for Dual Site HA , VOS Edge Routing Protocols
DoS Protection Policy: A policy of rules that matches traffic by source/destination address, zone, and service, and applies an allow, deny, or profile-based protect action to defend against denial-of-service attacks. See: Configure SD-WAN DoS Protection Policies , Configure SD-WAN DoS Protection Profiles
DoS Protection Profile: A profile referenced by a DoS protection policy that defines alarm, active, and maximum packet-rate thresholds — classified by source, destination, or both, or applied in aggregate — and the flood-protection action taken when thresholds are exceeded. See: Configure SD-WAN DoS Protection Profiles , Configure SD-WAN DoS Protection Policies
Driver Host: The name used within the Analytics application for an Analytics node that collects logs; driver hosts must be registered in Versa Director, and each one's log collector exporter, Analytics driver, and log archival are configured independently in the Director GUI. See: Configure Log Collectors and Log Exporter Rules , Configure Analytics Alarms
Drop Profile: A VOS CoS configuration object that defines how to handle congestion on an outbound queue nearing capacity, specifying WRED thresholds or tail-drop behavior for a scheduler's high or low loss priority. See: Configure CoS
DSL Access Multiplexer (DSLAM): A service-provider device that aggregates multiple DSL subscriber lines and connects them to a broader network; ADSL2+/VDSL2 NIC modules on CSG appliances connect customer premises equipment to a DSLAM. See: Network Interface Cards , Network Interface Cards
Dynamic Address Object: An address object type that acts as a container for an IP address list that can change at runtime without a configuration update, typically referenced in policy match criteria for hosts whose addresses change, such as during live VM migration. See: Configure Address Objects , Configure Policy-Based Forwarding
Dynamic Host Configuration Protocol (DHCP): A client-server protocol that dynamically assigns IP addresses and other network configuration parameters, such as gateway and DNS servers, to devices from a configured address pool, avoiding manual configuration. See: DHCP Logs , Analytics Log Collector Log Types Overview
Dynamic Tunnel Virtual Interface (DTVI): A dynamically created data-plane tunnel interface, prefixed "dtvi," built between SD-WAN branches from information the branch receives from an SD-WAN Controller node. See: Understand SD-WAN Interface Numbering

E

East-West Traffic: Network traffic that flows laterally between workloads within or between internal networks, such as between cloud VPCs or within a single VPC, as distinct from traffic entering or leaving the network. See: VOS High Availability in AWS Using Gateway Load Balancer
Easy Quick Picks: A Titan Portal and Titan Mobile feature that repopulates a single device configuration area, such as Wi-Fi, LAN, security, or steering, with the organization's default values in one click, without affecting other configuration areas. See: Titan Portal 9.1.1 , Getting Started with Titan Portal
EIP Agent Profile: A profile, associated with a secure client access rule, that defines which endpoint posture categories and conditions the Versa SASE client collects and reports to the SASE gateway for continuous evaluation; the matching EIP profile defines how the reported data is evaluated. See: Configure Endpoint Information Profiles , Step-By-Step Guide for Endpoint Identity Profile (EIP) Configuration
EIP Object: The building block of an Endpoint Information Profile that defines match criteria for a single endpoint attribute, such as antivirus vendor, disk encryption status, or OS version, used to evaluate raw posture data reported by the SASE client. See: Configure Endpoint Information Profiles , Step-By-Step Guide for Endpoint Identity Profile (EIP) Configuration
EIP Profile: A collection of rules, each grouping EIP objects from a posture category, that determines how collected endpoint data is matched: objects within a rule use OR logic, while rules across different categories must all match for the profile to be satisfied. See: Step-By-Step Guide for Endpoint Identity Profile (EIP) Configuration
Elastic IP Address: A floating, load-balancer IP address for a VMS cluster to which external sources and agents send data; it is not bound to any single VMS node, and with multiple nodes VRRP elects the active node to receive this traffic. See: Install and Configure VMS
Elasticity: A VOS device capability that scales an appliance by running multiple virtual service nodes; when elasticity is configured, individual virtual service nodes are distinguished by unique vsnId values in log records. See: Event Logs
Elephant Flow: A single, large-volume network session, such as an FTP download or file copy, that poses distinct challenges for SD-WAN traffic steering and is addressed with techniques such as per-packet load balancing, gradual migration, and forward error correction. See: Consolidated SD-WAN Design Guide , SD-WAN Traffic Optimization
Elliptic-Curve Diffie-Hellman Key Exchange (ECDHE): A TLS key exchange algorithm, based on elliptic-curve cryptography, selectable for negotiating the security parameters of a TLS connection that supports a version earlier than TLS 1.3. See: Configure SD-WAN TLS Decryption , Configure SD-WAN TLS Decryption in Concerto
Encapsulating Security Payload (ESP): An IPsec protocol, IP protocol number 50, that provides confidentiality, integrity, and authentication for tunneled IP packets; Versa SD-WAN uses ESP to encrypt control- and data-plane traffic between Controller nodes and CPE devices. See: Configure SD-WAN Access Control Policies , Configure SD-WAN Header Compression
End of Life (EOL): The point at which Versa Networks stops providing new features, enhancements, and bug fixes for a software release; major releases reach EOL after two years and minor releases after three, each followed by a one-year EOL support period before end-of-support. See: Versa Networks Software Release Lifecycle and End-of-Life Policy
End of Support (EOS): The state a Versa Networks software release reaches at the end of its one-year end-of-life period, after which Versa Networks no longer accepts support cases for that release. See: Versa Networks Software Release Lifecycle and End-of-Life Policy
End-Entity Certificate (EE): A certificate, signed by a CA certificate, that is issued to a specific end device or interface, for example to establish an IPsec connection with remote access clients. See: Generate CA and EE Certificates Using OpenSSL
Endpoint Client Service: A Versa Director template type that configures Remote Access VPN connectivity, including authentication, VRF attachment for IPsec tunnel termination, and client portal and gateway setup. See: Configure an Endpoint Client Service (Remote Access VPN) Template , Configure an Endpoint Client Service (Remote Access VPN) Template
Endpoint Detection and Response (EDR): A category of security software that monitors endpoint devices such as laptops, phones, and IoT devices for threats and enables response; Versa integrates third-party EDR platforms via VMS to feed endpoint risk data into unified entity risk profiles. See: Configure VMS to Integrate EDR Platforms , Configure ASC Worker Nodes and Deploy Versa Secure Lens
Endpoint Information Profile (EIP): A Versa construct that collects and evaluates an endpoint device's identity and security posture, such as antivirus status or OS version, using EIP objects, profiles, and agents, so decryption, microsegmentation, SD-WAN, and access rules can match on device compliance. See: EIP Logs , Analytics Log Collector Log Types Overview
Endpoint Posture: The security state of an endpoint device — installed security software, encryption status, and configuration compliance — evaluated against policy requirements; in Versa rules it is a match-criteria category combining endpoint information profiles, device compliance state, and entity risk bands. See: Configure SASE TLS Decryption , Configure Unified Risk Scores
Endpoint Protection Platform (EPP): A category of endpoint security software focused on preventing malware and threats on a device, configured alongside EDR products and weighted in a Versa unified entity risk profile. See: Configure Unified Entity Risk Profiles in Concerto , Configure Unified Risk Scores
Endpoint-Independent Filtering (EIF): A NAT filtering behavior that forwards an inbound packet from any external source to an internal host as long as it matches the destination IP address and port of an existing mapping, rather than restricting inbound packets to the original session's remote endpoint. See: Configure CGNAT , Configure Paired CPE Devices and Location IDs
Entitlement Manager: A Versa Director administration module for viewing and managing VOS device licensing, used to generate and export entitlement summary, query, subscription, and usage reports for tracking CPE licenses, bandwidth compliance, and chargeable events. See: License Reports , Director GUI Overview
Entity Confidence Score (ECS): A UEBA-derived, per-device risk score, with an associated band such as trustworthy, low-risk, moderate-risk, suspicious, or high-risk, sent by Versa Messaging Service to SASE gateways and recorded alongside the User Confidence Score in access and web logs. See: Flow Logs , User and Entity Behavior Logs
Entity Risk Score: A calculated score, grouped into bands such as Trustworthy, Low Risk, Moderate Risk, Suspicious, and High Risk, that estimates the likelihood that a user's or device's activity is legitimate or malicious for use in policy match criteria. See: Configure SASE Internet Protection Rules , Configure SASE Private Application Protection Rules
Equal-Cost Multipath (ECMP): A routing technique that load-balances traffic across two or more routes of equal administrative distance and cost to the same destination; VOS devices can enable ECMP for BGP paths, and SD-WAN designs deliberately break it when symmetric traffic flow is required. See: Networking , Configure Appliance Clustering
Ethernet Segment (ES): The set of Ethernet links connecting a multihomed switch to two or more branch devices in an EVPN multihoming topology. See: Configure EVPN Multihoming for SD-WAN
Ethernet Segment Identifier (ESI): A 10-octet, network-unique value that identifies an Ethernet segment — the set of links connecting a multihomed host to two or more devices in an EVPN topology — used to coordinate forwarding and prevent loops across those links. See: Configure EVPN Multihoming for Hosts Using ZT-LAN , Configure EVPN VXLAN for ZT-LAN
Ethernet VPN (EVPN): A BGP-based control-plane technology (RFC 7432) that carries Layer 2 Ethernet traffic as a virtual private network over an IP or MPLS underlay, distributing MAC and IP reachability information between edge devices and supporting multihoming. See: Networking , Configure EVPN Multihoming for Hosts Using ZT-LAN
Event Notification: An AMQP notification that Versa Director publishes when an event, such as an appliance status change, HA transition, or ZTP milestone, occurs; it is identified by a routing key encoding severity, event type, entity, organization, and user. See: AMQP Event Notifications
EVPN Multihoming: An EVPN capability that connects a host or Layer 2 switch to two or more branch devices over an Ethernet segment for redundancy and load balancing, operating in all-active mode, where all links forward, or single-active mode, where one forwards and the others stand by. See: Configure EVPN Multihoming for Hosts Using ZT-LAN , Configure EVPN Multihoming for SD-WAN
Exact Data Match (EDM): A DLP detection technique that matches traffic content against a specific, pre-indexed dataset of sensitive records, such as an uploaded CSV of customer data, rather than generic patterns, reducing false positives. See: Security , Manage Files and Folders
Explicit Proxy: A proxy mode in which clients are explicitly configured with the proxy's IP address and port, as opposed to a transparent proxy; on VOS this lets the device apply security policy and TLS decryption to proxied HTTP/HTTPS traffic, including chaining to another proxy. See: Configure Kerberos Authentication , Explicit Web Proxy with SD-WAN Traffic Steering
Export Control Classification Number (ECCN): A classification code under U.S. export control regulations assigned to hardware and software components, such as IPsec toolkits and encryption modules used in CSG and CSX appliances, to determine export restrictions. See: CSG700 Series Hardware Guide , CSX2000 Series Appliance Specifications
Extensible Authentication Protocol (EAP): An authentication framework, supporting methods such as MD5, MSCHAPv2, and TLS, used by 802.1X to exchange credentials between a supplicant and an authenticator and to authenticate remote access VPN clients. See: Configure IPsec VPN Profiles , Dot1X
Exterior Gateway Protocol (EGP): A class of routing protocol used to exchange reachability information between different autonomous systems, as distinguished from an interior gateway protocol used within a single autonomous system; BGP is the standard EGP used on VOS devices. See: Configure BGP
External BGP (EBGP): A BGP session established between peers in different autonomous systems; VOS devices apply distinct defaults, such as TTL and route preference, to EBGP sessions, and Versa recommends EBGP for site-to-site IPsec tunnels requiring high availability. See: Configure BGP , Configure BGP Import and Export Rules
Extract, Transform, Load (ETL): The process of extracting raw data from a source, transforming it into a usable structure, and loading it into a target datastore; the Versa Analytics driver performs ETL on collected log files to populate the cluster's database and search-engine datastores. See: Monitor Analytics Clusters , Manage Versa Analytics Log Archives

F

Fail Mode: A SASE client setting, Fail-Open or Fail-Close, that determines internet access when the client loses its gateway connection: Fail-Open permits access with or without a connection, while Fail-Close permits access only while connected to a Versa Cloud Gateway. See: Use the Versa SASE Client Application , Use the Versa SASE Client with Concerto
False Positive: An IDS/IPS event in which benign traffic is incorrectly classified as malicious, producing an alarm even though no attack has taken place. See: Configuring Intrusion Detection and Prevention , How to enable and verify IPS/IDS profile
Federal Information Processing Standards (FIPS): A set of U.S. government security standards, developed by NIST, for cryptographic modules in hardware and software; Versa offers FIPS-compliant software images, and VOS devices can operate in FIPS mode to meet FIPS 140-2 Level 1 requirements. See: Use the Versa SASE Client Application , Versa Software Types
Field-Replacement Unit (FRU): A hardware component, such as a power supply unit or cooling fan, designed to be replaced on-site without returning the appliance to the manufacturer; CSG and CSX appliances use redundant, hot-swappable FRU power supplies and fans, covered under Versa's hardware warranty. See: Hardware Support Overview , CSG2500 Hardware Guide
File Filtering: A security capability that inspects files by their actual content-based type, size, protocol, and transfer direction, computes file hashes, and optionally performs cloud-based reputation lookups, then blocks, alerts on, or allows transfers of potentially dangerous or malicious files. See: Configure File Filtering , Configure File Filtering (NGFW)
File-Filtering Profile: A profile defining the rules used to filter files entering and leaving the network, including a default action, SHA-256/SHA-384 hash allow and deny lists, file-based rules by type, size, protocol, and direction, and reputation-based cloud lookup rules. See: Configure SD-WAN File-Filtering Profiles , Configure SD-WAN Access Control Policies
FIPS 140-2: A U.S. government cryptographic-module security standard; VOS devices can operate in a FIPS 140-2 Level 1 compliant mode with restricted cipher sets, and CSG700 appliances are designed as fixed platforms with no field-replaceable parts to meet Level 2 compliance. See: CSG700 Series Hardware Guide , Network Interface Cards
Firewall as a Service (FWaaS): A cloud-delivered firewall model, unified with SWG, CASB, and ZTNA under SASE, that moves firewall inspection from on-premises appliances to scalable, multi-tenant cloud services protecting users, devices, and applications from internal and external threats. See: Concerto SASE End-to-End Configuration , Solution Components
FlexVNF: The earlier product name for the Versa Operating System (VOS), displayed in the device login banner and CLI branding on Versa appliances and virtual network functions; third-party marketplaces list the deployable VNF image as "Versa FlexVNF". See: Install on KVM , Install on Bare Metal
Flow Log: A log message that VOS devices generate for a traffic flow (session), consisting of a flow identification message followed by service-specific messages such as ADC, ATP, DLP, CASB, DNS-filtering, or SD-WAN traffic logs for that flow. See: Flow Logs , SD-LAN Event Logs
Forensic Profile: A Concerto profile that defines the cloud application instance and storage location to which a copy of a matched file and a forensic report are sent for data forensics analysis, while the original file is retained unchanged. See: Configure Forensic Profiles in Concerto
Forward Error Correction (FEC): A technique in which the sender adds redundant parity packets to a transmission so the receiver can reconstruct lost packets without retransmission, used on lossy SD-WAN links to improve application experience. In MPLS contexts, FEC instead expands to Forwarding Equivalence Class – the group of packets an ingress router forwards the same way; see MPLS. See: MPLS , Networking , Core Platforms
Forwarding Class (FC): A QoS traffic classification on VOS devices, numbered FC0 through FC15 and grouped into Network Control, Expedited, Assured, and Best Effort categories, that determines how packets are queued, scheduled, and marked and how per-class SLA statistics are reported. See: Event Logs , SD-WAN Dashboards
Forwarding Profile: A configuration object that defines how traffic matching an SD-WAN policy rule is forwarded, including circuit and path priorities, connection method, load balancing, SLA enforcement and violation actions, and traffic-conditioning options such as FEC, packet replication, or symmetric forwarding. See: Monitor VOS Device Services , Workflow-Based Split Tunnel Options Explained
Full Mesh Topology: A network topology in which every site or branch establishes direct tunnels to every other for any-to-any communication rather than routing through a central hub, offering the lowest latency but requiring SLA monitoring between every pair of sites. See: Versa SD-WAN Design Guide , Consolidated SD-WAN Design Guide
Full Tunnel: A VPN tunneling mode in which all client traffic, including internet-bound traffic, is routed through the secure tunnel rather than only traffic destined for private resources; it is the only tunnel mode available for remote access VPN. See: Titan Portal 9.1.1 , Portal for Titan Order Management for MSPs
Fully Qualified Domain Name (FQDN): The complete domain name that uniquely identifies a host, used in Versa configurations as a match value in address objects, SLA and SaaS application monitors, DNS/IP-filtering profiles, and as a peer-identity format for IPsec tunnels. See: Configure Reusable Objects , Configure SaaS Application Monitoring

G

Galois/Counter Mode (GCM): An authenticated encryption mode for AES that provides confidentiality and integrity in a single pass; offered in VOS IPsec transforms such as AES-128-GCM and AES-256-GCM. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure the Versa Secure Access Service
Gateway Group: A named collection of SASE gateways, sharing a common FQDN, that a client or access rule can reference; a Versa SASE client directed to the group is connected to the most optimal member gateway based on proximity, load, and latency. See: Configure SASE Tenants , Configure the Versa Secure Access Service (Secure SD-WAN)
GenAI Firewall: A Versa security capability that monitors and controls generative AI application traffic through real-time content inspection, DLP, and URL-filtering enforcement, discovering unauthorized (shadow) GenAI tools and preventing sensitive data from being uploaded to services such as ChatGPT. See: Security , Core Platforms
General Data Protection Regulation (GDPR): The European Union data-privacy regulation; Versa DLP ships predefined profiles that detect and protect the categories of personal data GDPR governs. See: Concerto SASE End-to-End Configuration , Configure Analytics Aggregator Nodes
Generic Network Virtualization Encapsulation (Geneve): An encapsulation protocol that enables network virtualization by encapsulating Layer 2 Ethernet frames inside UDP packets for transport over Layer 3 networks; used by the AWS Gateway Load Balancer to forward traffic to VOS inspection appliances over a terminated Geneve tunnel interface. See: Configure Site-to-Site Tunnel Interfaces in Concerto , VOS High Availability in AWS Using Gateway Load Balancer
Generic Routing Encapsulation (GRE): A tunneling protocol that encapsulates one network-layer protocol's packets inside another to carry traffic across intermediate networks; VOS supports point-to-point and point-to-multipoint GRE tunnels, alone or combined with IPsec, for connecting branches to non-SD-WAN networks and cloud hubs. See: Networking , Configure NPU Traffic Mirroring
Geo Circle: A custom geographic location object defined by a latitude/longitude point and a surrounding radius, used to match traffic in VOS policy rules by geographic area. See: Configure Geolocation Objects
Global Navigation Satellite System (GNSS): A satellite-based positioning receiver built into Versa LTE and 5G modem modules that enables device tracking and location-based services on CSG and CSM appliances, supporting constellations such as GPS, GLONASS, Galileo, and BeiDou. See: LTE Modem Module , LTE Modem Module
Global Zero Touch Provisioning (GZTP): An activation method that provisions a Versa appliance automatically over the internet using its serial number, without an on-site technician: the powered-on device calls home to a cloud staging server, which validates it and completes activation. See: Titan Portal 9.1.0 , Activate VOS Devices
gRPC: A high-performance remote procedure call framework used on VMS's southbound interface; VOS devices, branches, and gateways establish long-lived gRPC connections to subscribe to and stream data with VMS, such as UEBA confidence-band mappings. See: Enable and Configure VMS Services , HA-Based VMS Deployment in Headend Environment
Guest VLAN: A VLAN that provides limited network access to devices that fail 802.1X authentication or that do not support 802.1X, assigned when no device successfully authenticates on the port. See: Configure Dynamic VLAN Assignment Using 802.1X Authentication , Configure IEEE 802.1X Device Authentication
Guest VNF: A virtualized network function hosted on a VOS device, also called a universal CPE, through which traffic can be service-chained; Analytics reports guest VNF health, interface, and event log statistics. See: System Dashboards
Guest Wi-Fi: A wireless network segment on a Versa appliance, accessed through a dedicated port and SSID, that restricts connected guests to internet access only, without access to the corporate VPN. See: Use the Configure Dashboard , Onboard CPE Devices in Versa Titan

H

HA Cross-Connect Port: A dedicated physical port on each device in a Titan high-availability pair that emulates the missing transport domain between redundant CPE devices, providing failover connectivity to attached clients. See: Configure LAN Connections
Handshake Protocol: The TLS sub-protocol that authenticates the client and server at each end of a secure channel, negotiates cryptographic modes and parameters, establishes shared keying material, and passes messages to the record protocol. See: Configure SD-WAN TLS Decryption , Configure SD-WAN TLS Decryption in Concerto
Headend: The collective term for the centralized management and control components of a Versa deployment — Director, Analytics, and Controller nodes, optionally with the Concerto orchestrator — typically hosted in a data center and managing branch and hub VOS devices. See: Headend Overview , Hardware and Software Requirements for Headend
High Availability (HA): A deployment model that pairs redundant devices or nodes, such as an active and standby pair, so services continue without disruption if one fails; Versa supports HA for branch appliances, Director, Analytics, and Controller nodes. See: SD-WAN Dashboards , Manage Analytics Synchronization
High-Level Data Link Control (HDLC): A bit-oriented data-link-layer encapsulation that can be configured on VOS T1/E1 interfaces, supporting only a single subinterface (unit 0). See: Configure Interfaces
Honeycomb View: The default grid-based dashboard layout in Titan Portal and Concerto in which each hexagonal tile represents a site or device, color-coded by administrative, operational, or connectivity state, with alternative map and table views available. See: Deploy Lifecycle Overview , Configure Appliances, Hubs, and Hub–Controllers
Host Information Profile (HIP): A Palo Alto Networks report format describing an endpoint's security posture — OS, patch level, antivirus status, disk encryption — that Versa's VMS retrieves from Panorama and converts into the VOS endpoint information profile format. See: Enable and Configure VMS Services , HA-Based VMS Deployment in Headend Environment
Hub: A VOS device in a hub-and-spoke topology that spoke devices at branch sites connect to, configured with a site ID, transport addresses, and management addresses, and that can export application-monitoring metrics to its spokes. See: Configure SD-WAN Hubs , Configure SaaS Application Monitoring
Hub-and-Spoke Topology: A network topology in which branch (spoke) sites connect to one or more central hub sites that relay traffic between spokes and toward shared resources or the internet, in variants such as spoke-to-hub-only and spoke-to-spoke via hub. See: Configure Spoke Groups , Solution Architecture
Hub-Controller Node (HCN): A VOS device role combining hub and Controller functions for the spokes in its region, typically used when branches sit on a private MPLS network without direct access to a Versa-hosted Controller; spokes tunnel to local HCNs, which alone connect to top-level Controller nodes. See: Consolidated SD-WAN Design Guide , Configure Appliances, Hubs, and Hub–Controllers

I

Identity and Access Management (IAM): A framework of policies and technologies for managing digital identities and controlling their access to resources; Versa ZTNA and NGFW integrate with IAM platforms to make dynamic, identity-based access decisions. See: Security
Identity and Authentication Engine (IAE): A Versa solution providing centralized management of user identity and access, offering identity-provider services that integrate with directories such as Active Directory and Azure AD, support LDAP, SAML, and RADIUS, and distribute authentication context to WAN edge, SD-LAN, and gateway devices. See: Configure a Secure SD-WAN Tenant , Configure SASE Tenants
Identity Provider (IdP): An external service, such as Okta, OneLogin, ADFS, or Ping Identity, that authenticates users and issues assertions confirming their identity, which a service provider consumes during single sign-on to grant or deny access without directly managing credentials. See: Best Practices for CASB Security
IEEE 802.1p: An IEEE standard defining a priority field carried in the VLAN tag of Ethernet frames; VOS devices can classify incoming traffic by its 802.1p value and rewrite that value on outbound frames for QoS handling. See: Configure CoS for SD-LAN , Configure Hierarchical Scheduling
IEEE 802.1Q Tunneling (Q-in-Q): A double-VLAN-tagging standard that lets service providers separate customer traffic with overlapping VLAN IDs, configurable as inner VLAN tagging on Versa WAN and LAN interfaces. See: Configure Q-in-Q Inner VLAN Tagging in Concerto , Configure Interfaces
IEEE 802.1X: A port-based network access control standard that authenticates devices connecting to a LAN or switch port; used throughout Versa SD-LAN for device and user authentication, including dynamic VLAN assignment and certificate-based authentication. See: Analytics Log Collector Log Types Overview , SD-LAN Event Logs
Industrial Control System (ICS): Operational-technology systems that monitor and control industrial processes; Versa IoT security identifies ICS devices and protocols and applies policy to them. See: Titan Portal 9.1.1 , Titan Mobile 9.3.0
Infrastructure as a Service (IaaS): A cloud service model that delivers virtualized compute, storage, and networking resources over the internet, such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform, which customers manage remotely rather than owning physical hardware. See: Best Practices for CASB Security , View Concerto Security Dashboards
Inline CASB: A CASB deployment model in which the SSE gateway inspects SaaS traffic in real time as users access cloud applications, enforcing activity-level controls on logins, uploads, downloads, and sharing. See: Best Practices for CASB Security
Integrated Routing and Bridging (IRB): An interface type that associates a Layer 3 interface with a Layer 2 bridge domain so packets can be routed to and from that domain; also called a switched virtual interface (SVI). See: Configure Appliances, Hubs, and Hub–Controllers , Configure Main Templates
Intelligent Platform Management Interface (IPMI): An out-of-band management protocol and dedicated port that lets administrators monitor and manage server hardware, including power, sensors, and remote console, independently of the main operating system; CSG2500 and CSG5000 series appliances include a dedicated IPMI port. See: Install on Bare Metal , Install and Configure VMS
Interior Gateway Protocol (IGP): A routing protocol that distributes routes within a single autonomous system, such as OSPF or IS-IS; supported on VOS devices for LAN- and WAN-side routing. See: Configure Virtual Routers , Configure BGP
Internal BGP (IBGP): A BGP session established between peers in the same autonomous system, used to distribute externally learned routes within that AS; VOS devices apply route preferences and other defaults specific to IBGP sessions. See: Configure BGP
International Mobile Equipment Identity (IMEI): A 15-digit number that uniquely identifies a mobile device's hardware on a cellular network; SASE for SIM can enforce strict IMEI checking to verify that traffic originates from an authorized device. See: Enable and Configure VMS Services , Configure SASE for SIM
International Mobile Subscriber Identity (IMSI): A unique identifier stored on a SIM card that identifies a mobile subscriber; Versa SASE for SIM uses the IMSI to authenticate and authorize SIM-enabled devices without requiring a software client. See: Secure Access Dashboards , Enable and Configure VMS Services
Internet Control Message Protocol (ICMP): A network-layer protocol used for diagnostics and error reporting; VOS devices use ICMP echo probes for SLA monitoring, liveness detection, and troubleshooting tools such as ping. See: Configure WAN Interfaces in Concerto , Consolidated SD-WAN Design Guide
Internet Gateway (IGW): A Direct Internet Access capability, configured on hub devices, that provides centralized internet access by advertising a default route to spoke sites and redirecting their internet-bound traffic to the hub. See: Configure SD-WAN Topology and LAN Routing Protocols , Versa Networks SASE Gateway Integration with AWS Cloud
Internet Group Management Protocol (IGMP): The protocol hosts use to signal multicast group membership to a directly connected router; Versa VOS supports IGMP versions 1, 2, and 3, with IGMPv3 adding support for source-specific multicast. See: Networking , Multicast
Internet Key Exchange (IKE): The protocol used to authenticate IPsec tunnel endpoints, negotiate cryptographic parameters such as encryption, hash, and Diffie-Hellman group, and establish keying material for an IPsec security association; Versa supports IKE version 1, version 2, or either. See: View Concerto SD-WAN Dashboards , Monitor VOS Device Services
Internet Key Exchange version 2 (IKEv2): A protocol used to establish and manage security associations for IPsec tunnels; the Versa SASE client uses IKEv2/IPsec tunneling to establish secure connections to SASE gateways. See: Core Platforms , Use the Versa SASE Client Application
Internet of Things (IoT): The network of interconnected physical devices, embedded with sensors and connectivity, that communicate and exchange data over the internet, spanning categories such as smart home, healthcare, industrial, and connected-vehicle devices. See: Configure IoT Security , View Security Analytics Data (NGFW)
Internet Protection Rule: A per-tenant SASE firewall rule that matches internet-bound traffic on criteria such as application, URL category, user, and geolocation, and applies an allow, deny, or reject action plus optional security profiles. See: Best Practices for CASB Security , Versa SASE Portal Overview
Internet Protocol Security (IPsec): A protocol suite that authenticates and encrypts IP traffic to build secure tunnels; Versa uses IPsec for the encrypted SD-WAN overlay, site-to-site tunnels, and SASE client remote-access VPN connections, with IKE for key exchange. See: Monitor VOS Device Services , Configure a Branch SD-WAN Profile
Intrusion Detection and Prevention (IDS/IPS): Security functions that inspect network traffic for known attack signatures and vulnerabilities, detecting (IDS) and blocking (IPS) attacks using signature-based and anomaly-detection methods; offered in Versa SD-WAN Gateway and NGFW security services. See: SD-WAN Solution Architecture , Consolidated SD-WAN Design Guide
Intrusion Detection System (IDS): A system that examines network traffic for indications of vulnerabilities and inappropriate or anomalous activity, detecting threats without necessarily blocking them; typically deployed off a switch spanning port, hub, or network tap rather than inline. See: Use SPacks with Concerto , Use Security Packages (SPacks)
Intrusion Prevention System (IPS): A security system, typically placed at the network perimeter, that monitors traffic for inappropriate or anomalous activity using signature-based and anomaly-based detection and responds automatically by dropping packets, resetting connections, or blocking IP addresses. See: Security , Core Platforms
IoT Security: A Versa capability that discovers and fingerprints IoT and OT devices through deep packet inspection, applies microsegmentation to prevent lateral movement, and enforces NGFW, IPS, ATP, and DLP policies on IoT traffic without requiring endpoint agents. See: Security , Configure Microsegmentation
IP Address Management (IPAM): The practice and tooling for allocating, tracking, and managing IP address space; Versa Director uses an IPAM service to assign SD-WAN overlay management addresses, WAN interface address pools, and remote access VPN address pools. See: Configure IPsec VPN Profiles , Configure the Overlay Addressing Scheme
IP Filtering: A VOS security capability that filters traffic based on IP address reputation, geolocation, and administrator-defined allow and deny lists, enforcing actions such as allow, alert, drop, or reset on matching traffic. See: Configure SD-WAN Security Access Control Policies and Rules , Best Practices for Next-Gen Firewall as a Service (NGFWaaS)
IP Flow Information Export (IPFIX): An IETF standard flow- and log-export format, derived from NetFlow version 9, that VOS devices use to send log data to Versa Analytics nodes and NetFlow-compatible collectors. See: Analytics Log Collector Log Types Overview , Configure Log Collectors and Log Exporter Rules
IP Multicast: A suite of protocols for distributing data from a single source host to many receivers over an IP network in a bandwidth-efficient manner, replicating packets along a shared-tree or source-tree topology instead of sending one copy per receiver. See: Multicast , Configure IP Multicast
IP Reputation: A classification of an IP address's likelihood of association with malicious activity, such as botnets, phishing, spam, or scanning, used by security policies to block or allow traffic to or from that address. See: Configure IP Filtering , Configure IP Filtering (NGFW)
IP SLA Monitor: A reusable configuration object that actively checks whether an IP address or FQDN is reachable by sending DNS, HTTP, ICMP, or TCP probes; attached to static routes, redistribution policies, or monitor groups to trigger failover actions. See: Workflow-Based Split Tunnel Options Explained , LTE Transport Modes
IP SLA Monitor Group: A reusable object that combines multiple IP SLA monitors using an AND or OR operation to determine the overall reachability of the group. See: Configure Reusable Objects
IP SLA Monitoring: A method of actively and continuously monitoring reachability and performance by sending probe packets across the network; VOS devices use it to drive actions such as static-route withdrawal, backup-path activation, and traffic-steering decisions. See: Configure Data-Driven SLA Monitoring , Configure EVPN Multihoming for SD-WAN
IP Source Guard: A LAN security feature that validates the source IP address of traffic on an interface against the DHCP snooping binding table, blocking spoofed traffic; on VOS devices it requires DHCP snooping and can be enabled per bridge domain or routing instance. See: SD-LAN Event Logs , Configure IP Source Guard
IP-Filtering Profile: A profile that defines match criteria and enforcement actions for filtering traffic by IP reputation and geolocation, referenced by an access control security policy. See: Configure SD-WAN IP-Filtering Profiles , Configure SD-WAN Access Control Policies
IPS Profile: A profile of vulnerability rules matching criteria such as CVE year, confidence, CVSS score, class type, direction, and application, with signature- and anomaly-based enforcement actions and optional exceptions, referenced by an access control policy. See: Configure SD-WAN IPS Profiles , Configure SD-WAN IPS-Filtering Policies
IPsec Transform: A configured set of encryption and authentication algorithms, such as esp-aes-128-md5, applied to an IPsec tunnel to protect traffic between VOS devices or between tenant appliances programmed by Versa Concerto. See: Configure the IPsec Transform and DH Group for Branch-to-Branch Deployments , Configure Site-to-Site Tunnels
IPsec VPN Profile: A Versa Director configuration object that defines IKE and IPsec tunnel properties, such as rekey timers, encryption transforms, and authentication, used between a tenant and SD-WAN devices for staging, post-staging, or site-to-site connectivity. See: Configure IPsec VPN Profiles

K

Kafka: Apache Kafka, an open-source distributed event-streaming and messaging platform; Versa uses it as the messaging backbone for the Versa Messaging Service and for publishing Director object-change and event notifications. See: Install and Configure VMS
Kafka Connector: A Versa Director connector that publishes Director events and alarms, object-change events, task notifications, and VOS device events to an Apache Kafka broker for northbound consumption; Concerto configures one automatically to exchange events with Director. See: Kafka SASL SSL Support in Concerto , Troubleshoot Concerto Nodes
Kafka MirrorMaker: An Apache Kafka tool that replicates topic data between Kafka clusters; Versa uses it between paired VMS nodes for disaster recovery, geo-replication, and integrations such as EDR platforms. See: Configure VMS to Integrate EDR Platforms , Install and Configure VMS
Kerberos: A network authentication protocol that uses secret-key cryptography and time-stamped tickets issued by a key distribution center to authenticate users and services without transmitting credentials over the network. See: Manage Organization Settings , Configure Kerberos Authentication
Key Distribution Center (KDC): The Kerberos component that receives a client's forwarded username, issues a ticket-granting ticket encrypted with the ticket-granting service's secret key, and returns it to the requesting client. See: Configure Kerberos Authentication , Configure Kerberos Authentication (NGFW)
Key Management Interoperability Protocol (KMIP): A client-server protocol for key management and cryptographic operations on a key management server; VOS devices can act as KMIP clients, connecting to a KMS over TLS on port 5696 to generate symmetric keys and asymmetric key pairs. See: Configure Certificate Servers , Configure a Common Certificate Authority
Keytab File: A file containing Kerberos principal and encrypted key pairs, generated from an Active Directory account and uploaded to VOS devices, that authenticates systems and services without requiring a password to be entered. See: Configure Kerberos Authentication , Configure Kerberos Authentication (NGFW)
Kubernetes: An open-source container-orchestration platform; VMS uses a Kubernetes-based microservice architecture with a control-plane node that initializes and manages the cluster's orchestration, configuration, and health monitoring. See: Install and Configure VMS

L

LAN Profile: A reusable Titan configuration object applied to Ethernet ports and Wi-Fi interfaces that defines IRB interfaces, VLANs, 802.1X authentication, Spanning Tree Protocol, and Link Aggregation Group settings. See: Versa Titan Release Notes for Release 10.0, 10.1.2, and 10.2.2
LAN Virtual Router: A per-tenant virtual router on a VOS device responsible for the device's LAN-side interfaces and their virtual routing and forwarding; it is paired with a control virtual router that advertises its routes to other devices. See: Understand SD-WAN Interface Numbering , Solution Use Cases
Lateral Movement: An attack technique in which an intruder moves progressively through a network after initial infiltration to discover assets and modify, restrict, or exfiltrate data; Versa ZT-LAN detects it using inline traffic inspection and an extended IPS threat library. See: ZT-LAN Features and Capabilities , Configure Microsegmentation for SD-LAN
Lateral Movement Detection: A Versa vulnerability profile that detects post-exploitation techniques attackers use to propagate through a network after gaining an initial foothold, applied as a firewall rule action and logged for forensic analysis. See: How to configure Lateral Movement Detection profile
Layer 3 VPN (L3VPN): A BGP/MPLS VPN service that carries routed IP traffic for a customer VRF across a provider's core network; VOS devices can interoperate with an MPLS L3VPN provider using Inter-AS Option A or Option B. See: Inter-AS Option B , SD-WAN Solution Architecture
LEF Collector: A configuration object that defines the destination address and TCP or UDP port to which a VOS device sends an organization's logs over a LEF connection, such as an Analytics local collector or a third-party syslog or NetFlow server. See: Configure a Secondary Cluster for Log Collection , Configure the Versa Advanced Logging Service
LEF Profile: A configuration object on a VOS device that specifies the log export template (IPFIX or syslog) and the LEF collector or collector group to which a tenant's logs are sent; one profile per tenant can be designated the default. See: Configure a Secondary Cluster for Log Collection , Configure the Versa Advanced Logging Service
Legal Hold: A DLP or CASB enforcement action that preserves a copy of data or a file in a designated location for legal, regulatory, or investigative purposes without altering the original. See: Best Practices for CASB Security , Configure Data Loss Prevention in Concerto
Legal Hold Profile: A Concerto profile that specifies the SaaS or IaaS application instance and cloud folder where copies of files matching a DLP policy's legal hold action are preserved as evidence for a legal procedure. See: Configure Legal Hold Profiles in Concerto
Lightweight Directory Access Protocol (LDAP): A client-server protocol for querying a directory server, such as Active Directory, for user and group information; Versa devices and gateways use LDAP authentication profiles to validate credentials and retrieve group or role attributes. See: Configure Management Servers , Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)
Link Aggregation Control Protocol (LACP): A protocol that negotiates the bundling of multiple physical Ethernet links into a single logical aggregated interface, increasing throughput and providing redundancy; used for standard link aggregation and all-active EVPN multihoming. See: Configure Aggregated Ethernet Interfaces in Concerto , Configure EVPN Multihoming for Hosts Using ZT-LAN
Link Aggregation Group (LAG): A grouping of multiple physical interfaces into a single logical link to increase bandwidth and provide redundancy, configurable as part of a Versa LAN profile. See: Versa Titan Release Notes for Release 10.0, 10.1.2, and 10.2.2
Link Layer Discovery Protocol (LLDP): A vendor-neutral Layer 2 protocol, based on IEEE 802.1AB, that lets network devices advertise and discover neighboring devices' identities and capabilities on a LAN using type-length-value attributes; enabled by default in SD-LAN physical port profiles. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure LLDP
Link-State Advertisement (LSA): A message an OSPF router floods to describe its local links and routes, letting every router build an identical topology database and compute routes; types include router (Type 1), summary (Type 3), external (Type 5), and NSSA external (Type 7). See: Dealing with Backdoor Links on VOS Devices , Using OSPF for Dual Site HA
Live Monitoring: A Titan Portal dashboard that shows real-time device, service, and network status, including SD-WAN paths, IPsec sessions, routing protocol state, and CLI shell access, for a customer's connected appliances. See: Titan Portal 8.1.0
Local Breakout (LBO): The practice of sending trusted internet- or SaaS-destined traffic directly to the internet from the local branch rather than backhauling it to a central location, reducing latency and WAN load. See: Configure DNS Proxy with SD-WAN Traffic Steering for DIA , Versa Secure SD-WAN Integration with Versa SSE
Local Collector: A component of the log collector exporter on an Analytics node, configured with an IP address, TCP port, and storage directory, that listens for incoming LEF connections and stores received logs for processing into the cluster's datastores. See: Configure Log Collectors and Log Exporter Rules , Configure a Secondary Cluster for Log Collection
Log Collector Exporter (LCE): The program running on Analytics log collector nodes that accepts incoming LEF connections from VOS devices, stores logs locally through local collectors, and can stream them to remote systems, such as third-party SIEMs, through remote collectors and exporter rules. See: Configure Log Collectors and Log Exporter Rules , Analytics Log Collector Log Types Overview
Log Export Functionality (LEF): The VOS capability that forwards logs to Analytics log collector nodes or third-party syslog and NetFlow collectors over TCP or UDP connections; LEF profiles define where and how each feature's or policy's logs are exported. See: Configure Log Collectors and Log Exporter Rules , Configure a Secondary Cluster for Log Collection
Log Exporter Rule: A rule configured on an Analytics log collector node that matches specific log types, tenants, or appliances from a local collector and forwards the matching logs to the remote profile it specifies. See: Configure Log Collectors and Log Exporter Rules
Log Forwarder: A Versa Analytics function that strips IPFIX template overhead from device-exported logs and writes them to disk for the analytics database to consume; it can run as a standalone node type that forwards data to analytics and search nodes. See: Versa SD-WAN Design Guide , Overview of Analytics Troubleshooting
Logging Profile: A reusable object that defines the collectors and collector groups to which a VOS device forwards logs, either to a Versa Analytics cluster or to a third-party system. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
Long-Term Evolution (LTE): A cellular wireless broadband standard used by Versa appliances for internet connectivity, configurable as a primary, hot-standby, or cold-standby WAN circuit, particularly at branches without a wired connection. See: Titan Portal 9.1.1 , Titan Mobile 10.0
Loopback Interface: A virtual interface that is always operationally up regardless of physical link state, used for management and for protocols such as OSPF and BGP that require a continuously reachable address; a routing instance can have only one, always with a /32 mask. See: Configure Interfaces , Configure Loopback Interfaces in Concerto
Loss Priority (LP): A CoS attribute, set to High, Medium, or Low, assigned to classified traffic to indicate a packet's drop precedence during network congestion. See: Configure CoS for SD-LAN , Configure NPU Policy-Based Forwarding
LTE Advanced Pro (LTE-A Pro): An enhanced LTE cellular standard supporting higher data rates and carrier aggregation; CSG appliance embedded LTE modem modules use LTE-A Pro chipsets to provide primary or backup WAN connectivity, with a path toward 5G. See: CSG1000 Series Hardware Guide , CSG3000 Series Hardware Guide
LTE Modem Module: A pluggable or built-in cellular modem on CSG appliances that provides primary or backup WAN connectivity over LTE or 5G networks, supporting dual-SIM operation through externally accessible SIM slots. See: LTE Modem Module , LTE Modem Module

M

MAC Authentication Bypass (MAB): A fallback authentication method for devices that cannot perform 802.1X, in which the switch sends the endpoint's MAC address to a RADIUS server as its credentials, placing the device in an interim segment until authentication completes. See: Configure CWA Redirect Authentication for SD-LAN , Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)
MAC-VRF: A virtual routing and forwarding table used to install and look up MAC addresses for a tenant's bridge domain on a provider-edge device, identified in EVPN by route distinguisher, route target, and VNI. See: Configure EVPN VXLAN for ZT-LAN , Configure EVPN VXLAN for SD-WAN
Main Template: In Concerto Releases 13.1.1 and later, the top-level versioned configuration object that defines deployment tier, network interfaces, policies, servers and settings, Director service templates, and variables for one or more VOS devices; the successor to the master profile. See: Configure Main Templates , Versa Concerto for SD-WAN
Malware: Malicious software designed to disrupt computers and computer systems, including viruses, worms, Trojans, spyware, adware, and ransomware, that can leak private information, gain unauthorized access, or deny access to information. See: Configure SD-WAN Malware Protection Profiles , Configure SD-WAN Malware Protection Policies
Malware Protection: Real-time inspection of files transferred over protocols such as HTTP, FTP, SMTP, and IMAP to detect and block malicious software using signature matching, heuristics, and emulation; TLS decryption is required to inspect files in encrypted sessions. See: Configure SD-WAN Security Access Control Policies and Rules , Configure Custom Malware Protection Profiles
Malware Protection Profile: A profile that scans selected protocols and file types for malware in a chosen traffic direction and enforces an alert, allow, deny, or reject action, referenced by an access control security policy. See: Configure SD-WAN Malware Protection Profiles , Configure SD-WAN Access Control Policies
Managed Service Provider (MSP): An organization that manages IT infrastructure and services for other organizations; in Titan Portal an MSP can create reseller and customer accounts, order devices and licenses, operate private SASE gateways, and manage customer devices on their behalf. See: Configure SASE Tenants , CSG5000 Hardware Guide
Management Interface: An out-of-band network interface on a VOS device, named with the prefix eth, used to log in to the device over SSH and to perform SNMP operations separately from data traffic. See: Configure Interfaces
Master Profile: In Concerto Releases 12.2.2 and earlier, the top-level device configuration object, organized into device, network service, application, security, and topology subprofiles, applied to one or more VOS devices; superseded by the main template in Release 13.1.1. See: Versa Concerto for SD-WAN , Configure Appliances, Hubs, and Hub–Controllers
Maximum Segment Size (MSS): A TCP header option specifying the largest amount of data, in bytes, a device can receive in one TCP segment; VOS devices adjust the MSS in transiting SYN packets to avoid fragmentation caused by tunnel headers or smaller path MTUs. See: Configure SD-WAN Header Compression , Configure Site-to-Site Tunnels
Maximum Transmission Unit (MTU): The largest packet size, in bytes, that an interface or network path can transmit without fragmentation. See: Configure Path MTU Discovery , Titan Portal 9.1.1
Mean Opinion Score (MOS): A numeric measure, from 0 to 5, of perceived voice, video, and audio quality; Versa SD-WAN uses MOS as an SLA criterion to steer real-time traffic onto WAN paths that meet a configured minimum score. See: Core Platforms , Networking
Microsegmentation: A security technique that divides a network into small, isolated segments and enforces granular access policy between them, limiting lateral movement by attackers or compromised devices; used across Versa's ZTNA, SD-LAN, and IoT Security capabilities. See: Security , Networking
MITRE ATT&CK: A globally accessible knowledge base of adversary tactics, techniques, and procedures based on real-world threat intelligence; Versa UEBA, NGFW, and Advanced Threat Protection file-analysis reports reference it to classify and explain malicious behavior. See: Security , Configure User and Entity Behavior Analytics (UEBA)
Mobile Device Management (MDM): Software that enrolls, configures, and enforces compliance and security policy on mobile and desktop endpoints; Versa secure access queries MDM platforms such as Microsoft Intune to enrich device-posture-based access decisions. See: Best Practices for CASB Security , Core Platforms
Mobile Network Operator (MNO): A telecommunications provider that owns or controls the cellular network infrastructure serving subscriber devices; SASE on SIM lets MNOs deliver SASE security to agentless subscriber devices. See: Configure SASE for SIM , SASE on SIM Solution Overview
Mobile Station International Subscriber Directory Number (MSISDN): The phone number associated with a single SIM card, used to place calls or send SMS messages to a device; recorded in VMS SASE-for-SIM user profiles for logging. See: Enable and Configure VMS Services , Configure SASE for SIM
Model Context Protocol (MCP): An open standard that lets AI applications such as Claude or ChatGPT connect to external data sources; Versa exposes MCP servers that give AI clients search over the documentation set and translate natural-language requests into Director and Concerto API calls. See: Set Up the MCP Server , Introduction
MPLS Service: A VOS Layer 2 services feature that lets a virtual switch inspect the contents of MPLS packets rather than only forwarding them, distinguishing flows to apply traffic steering and class-of-service operations across disjointed MPLS networks connected over SD-LAN. See: Configure Layer 2 Services
Multi-Exit Discriminator (MED): A BGP path attribute a router uses to indicate to an external peer which of several entry points into its autonomous system is preferred; a lower MED value is generally preferred over a higher one. See: Configure BGP
Multi-Factor Authentication (MFA): An authentication method requiring a user to provide two or more independent verification factors, such as a password plus a one-time code or device certificate, before access is granted. See: Concerto SASE End-to-End Configuration , Versa SASE Client Quick Start
Multi-User Multiple Input Multiple Output (MU-MIMO): A Wi-Fi capability that lets an access point transmit to multiple client devices simultaneously using multiple antennas, improving efficiency; embedded Wi-Fi modules on CSG150, CSG300, and CSG1000 series appliances support 2x2 MU-MIMO with 802.11ac Wave 2. See: Embedded Wi-Fi Module , Embedded Wi-Fi Module
Multihoming: A capability, also known as Multi-Chassis Link Aggregation Group (MC-LAG), that lets an access port connect to more than one network device simultaneously, increasing reliability and performance when combined with VXLAN. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)
Multiple Input Multiple Output (MIMO): A wireless antenna technology that uses multiple antennas to improve signal quality and throughput; Versa LTE modem and Wi-Fi AP modules use configurations such as 4x4 MIMO and 2x2 MU-MIMO. See: CSG700 Series Hardware Guide , LTE Modem Module
Multiple Spanning Tree Protocol (MSTP): A spanning-tree protocol defined in IEEE 802.1s that maps VLANs to multiple independent spanning-tree instances within a region, letting different VLANs or groups of VLANs use different loop-free topologies. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure Layer 2 Forwarding
Multiprotocol BGP (MP-BGP): An extension of BGP that carries multiple address families, including IPv6, VPNv4, VPNv6, and multicast; Versa Controllers use MP-BGP, augmented with SD-WAN-specific attributes, to distribute routes and topology information across the overlay. See: Networking , Multicast
Multiprotocol Label Switching (MPLS): A label-switching technology that forwards traffic through a provider core network; in Versa deployments MPLS underlays carry Layer 3 VPN traffic and serve as a WAN transport alongside internet, LTE, and satellite links. See: Networking , Inter-AS Option B
Multitenancy: The ability of a single VOS instance or platform to host multiple isolated organizations (tenants), each segmented with its own VRF and independently configurable topologies, policies, and services, supporting up to 256 tenants per instance. See: Configure Multitenancy , Versa Director REST API Overview
Multitenant Gateway: A gateway device shared across multiple tenant organizations, licensed by a total bandwidth or user count that an MSP divides among tenants; once deployed and activated, that allocation cannot be changed. See: Configure and Activate Multitenant Gateway Devices , Add Devices Using Titan Portal
Mutual TLS (mTLS): An authentication method in which both client and server present certificates and verify each other's identity during the TLS handshake, unlike standard TLS, which verifies only the server's identity. See: Configure VMS to Integrate EDR Platforms , Configure Concerto Infrastructure Lifecycle

N

NAT Traversal (NAT-T): A technique that allows IPsec/IKE traffic to pass through devices performing network address translation between tunnel endpoints; an IPsec VPN profile can force NAT-T regardless of whether NAT is detected on the path. See: Configure IPsec VPN Profiles , Configure Site-to-Site Tunnel Interfaces in Concerto
NAT64: A translation mechanism, defined in RFC 6146, that lets IPv6-only clients communicate with IPv4-only servers by translating between IPv6 and IPv4 addresses, typically paired with DNS64 for address resolution. See: Configure Virtual Routers , Configure CGNAT
Native VLAN: The VLAN associated with untagged packets received on a trunk-mode Layer 2 port, allowing an untagged packet to be treated as if it were tagged with that VLAN ID. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)
NETCONF: A network configuration protocol, run over SSH on TCP port 2022 in Versa deployments, that Versa Director uses to push configuration templates to and communicate with VOS devices via the Controller. See: Troubleshoot-Director to Appliance Reachability , Versa Director Issues
NetFlow: A flow-export protocol that VOS devices use to send IP traffic flow records to third-party collectors, configurable to log at session start, end, both, at fixed intervals, or on reset; Versa exports data compatible with NetFlow versions 9 and 10. See: Configure Log Export Functionality , Configure SD-WAN Traffic Monitoring
Network: A VOS configuration object that groups similar interfaces running on similar routing instances so they can be managed together; an interface can belong to only one network. See: Configure Networks
Network Access Control (NAC): A traditional approach to admitting users and devices onto an enterprise network that assumes any user with valid credentials is trusted, an assumption ZTNA solutions are designed to replace. See: Versa Secure SD-WAN Licensing Overview (2019 to 2024) , Versa Secure SD-WAN Licensing Overview (2025)
Network Access Server (NAS): The device that originates an access request to a RADIUS server on behalf of a user, identified in RADIUS authentication profiles by a NAS identifier, IP address, and port. See: Configure RADIUS for User Authentication
Network Address Port Translation (NAPT): A NAT method that translates both the IP address and the transport-layer port, letting many private addresses share one or a few public IP addresses by distinguishing sessions on port number. See: Consolidated SD-WAN Design Guide , Configure CGNAT
Network Address Translation (NAT): The process of mapping IP addresses from one address space into another as packets traverse a device; Versa supports NAT types including basic one-to-one, dynamic, destination, and carrier-grade NAT. See: Configure an Application Delivery Controller , Configure Application Layer Gateway
Network Interface Card (NIC): A field-installable interface module that adds Ethernet, PoE, ADSL2+/VDSL2, or T1/E1 ports to a Cloud Services Gateway appliance beyond its built-in ports, letting the same chassis be configured for different WAN or LAN needs. See: Network Interface Cards , Network Interface Cards
Network Layer Reachability Information (NLRI): The IP prefix and associated path-attribute information exchanged in BGP update messages that peers use to determine which destinations are reachable and to select the best route to each. See: Configure BGP , Configure SASE BGP Peer Policies
Network Obfuscation: A Versa Real-Time Protection capability that hides identities in SASE traffic: Remote User Obfuscation masks a connected user's IP address, while Application Obfuscation rotates a private application's IP per session to prevent lateral movement. See: Configure a DNS Proxy , Configure CGNAT
Network Prefix Translation (NPTv6): A stateless IPv6-to-IPv6 prefix translation function providing a one-to-one relationship between internal and external address prefixes while preserving end-to-end reachability at the network layer, similar in purpose to IPv4 NAT. See: Configure CGNAT , Configure Interfaces
Network Processing Unit (NPU): A dedicated forwarding-plane chip on Versa appliances such as the CSG3000, CSX4000, and CSG5000 series that performs wire-rate Layer 2 and Layer 3 packet forwarding, ACL enforcement, traffic mirroring, and hierarchical scheduling, offloaded from the general-purpose CPU. See: SD-LAN Event Logs , Flow Logs
Network Time Protocol (NTP): A protocol that synchronizes system clocks to within milliseconds of Coordinated Universal Time; Versa Director, Analytics, and VOS devices use NTP so log timestamps align and time-based cryptographic and SSO functions work correctly. See: Configure Management Servers , Deploy an SSE Gateway and Onboard Tenants Using Concerto
Network-to-Network Interface (NNI): A cross-connect interface reserved on a cloud-hosted SD-WAN branch device to interconnect with other services, such as UCaaS, cloud, or ISP providers, at a cloud interconnection point. See: Integrate and Orchestrate Cloud Onramp with a Software-Defined Cloud Interconnect Vendor
Next-Generation Firewall (NGFW): A firewall that combines traditional stateful packet filtering with application awareness, intrusion prevention, and URL filtering, applying policy based on application identity and user or group; part of the integrated security stack in the Versa Operating System. See: Security , Core Platforms
Next-Generation Firewall-as-a-Service (NGFWaaS): A cloud-delivered next-generation firewall capability providing application-aware inspection and enforcement without on-premises hardware, consolidated with SWG, CASB, and DLP within Versa Secure Internet Access. See: Security , Best Practices for Next-Gen Firewall as a Service (NGFWaaS)
NMS Organization: A network management system organization in Versa Director, associated with one or more CMS organizations (resource pools); the Director term corresponding to the industry concept of a customer. See: Versa Director REST API Overview , Configure VMS to Integrate EDR Platforms
Northbound Interface: A VMS management interface that communicates with external sources, such as a WMI agent, a RADIUS accounting server, SCIM, and threat feeds, normalizing their data for delivery to subscribed VOS devices and other Versa components. See: Install and Configure VMS

O

OAuth 2.0: An open, token-based authorization protocol used for API authentication in Versa Director, Analytics, and Concerto and for third-party integrations such as Microsoft Defender, supporting client registration, access-token issuance, refresh, and revocation. See: Versa Director REST API Overview , Integrate Versa SASE with Microsoft Defender
Object Versioning: Concerto's practice of saving each change to a configuration object as a new numbered version rather than overwriting it, so administrators choose which consumers receive the newer version; unused non-latest versions can be automatically deleted after a configurable age. See: Versa Concerto for SD-WAN , Versa Concerto for SD-WAN
One-Time Password (OTP): A single-use authentication code, delivered by email or SMS or generated by a time-based algorithm, used as a multifactor authentication step for SASE client registration and login. See: Configure User and Group Policy , Configure User and Group Policy (NGFW)
Online Certificate Status Protocol (OCSP): A protocol for checking a digital certificate's revocation status in real time; Versa TLS decryption profiles can enable OCSP verification to block traffic presenting revoked or unknown certificates, and Versa Director can bring IPsec tunnels up or down based on responder answers. See: Configure a Secure SD-WAN Tenant , Configure Certificate Servers
Open Shortest Path First (OSPF): An interior gateway protocol that uses a link-state routing algorithm to build a shortest-path map of a routing domain; OSPFv2 supports IPv4 and OSPFv3 supports IPv6, with domains organized into a backbone area (area 0) and non-backbone areas. See: Networking , Monitor VOS Device Networking Services
OpenID Connect: An open-standard authentication protocol that Concerto and Versa Director support as an alternative to SAML for single sign-on, configured with authorize, token, user-information, and revoke endpoints plus a client ID and secret. See: Configure Single Sign-On for Concerto , Configure Single Sign-On Using Director
Operations Support System / Business Support System (OSS/BSS): The category of external management and business systems, such as syslog collectors, TACACS+/RADIUS servers, and third-party VNF managers, to which a Versa SD-WAN control network must maintain IP reachability when integrated with a service provider's operations environment. See: Consolidated SD-WAN Design Guide , SD-WAN Headend Design Guidelines
Operator: The top-level Titan Portal role that creates store administrators and is the only role able to add a private, multitenant, or multitenant RAC/RAS gateway for a provider organization. See: Add Devices Using Titan Portal , Add SASE Gateway Devices
Optical Character Recognition (OCR): Technology that converts text embedded in images into machine-readable text; Versa DLP uses OCR to apply data protection policies to text extracted from image-based files. See: Configure Data Loss Prevention in Concerto , DLP Configuration Guide
Organization: The Versa Director and Controller construct representing a tenant, customer, or business unit under which devices, templates, and configurations are grouped and managed; organizations can nest as provider and tenant levels, each isolated. See: Director GUI Overview , Headend Overview
Organization Limits: Tenant-specific settings on a VOS device that constrain session rates and counts, QoS shaping and policing, and the interfaces, networks, routing instances, and provider organizations available to an organization. See: Configure Organization Limits
OS Security Package (OS SPack): A periodically released Versa package of operating-system security updates applied to Concerto, Analytics, Director, and VOS nodes to keep the underlying OS hardened against known vulnerabilities, distinct from the signature-based SPack. See: Perform Manual Hardening for Versa Analytics , Use OS Security Packages
Overlay Network: A logical network built on top of one or more underlay transports using encrypted tunnels, such as IPsec over VXLAN, providing traffic segregation, isolation, and privacy independent of the underlying transport. See: Configuring Disjoint Underlay MPLS Connections on Controller for Different Tenants , L2 Over SD-WAN with EVPN

P

Packet Capture (PCAP): A diagnostic feature that records packets matching a firewall, IPS, or traffic-monitoring rule, including packets surrounding a matched security event; captures are sent to an Analytics node, where they can be viewed and downloaded in pcap or text format. See: Versa Analytics Scaling Recommendations , View Analytics Dashboards and Log Screens
Packet Replication: An SD-WAN traffic-steering technique that duplicates packets and sends copies over multiple WAN paths; the receiving device forwards whichever copy arrives first and discards duplicates, improving resiliency for loss-sensitive traffic such as voice. See: Consolidated SD-WAN Design Guide , SD-WAN Traffic Optimization
Path: The end-to-end route between a local branch and a remote branch in SD-WAN, traversing a local access circuit and a remote access circuit; when each branch has multiple circuits, multiple paths can exist between the two sites. See: SD-WAN Dashboards , Configure SD-WAN Traffic Steering
Path MTU Discovery (PMTUD): A mechanism by which VOS devices determine the maximum transmission unit size supported along the network path between two IP hosts, periodically re-probing the path to keep the discovered value current. See: Configure Path MTU Discovery
Path Policy: An SD-WAN policy whose terms match traffic by remote site type, hub group, or WAN circuit name, type, or media, and configure SLA monitoring, adaptive SLA monitoring, and bandwidth monitoring on the resulting paths. See: Configure SD-WAN Path Policy
Payment Card Industry (PCI): Shorthand for the PCI Data Security Standard governing payment-card data; Versa DLP and firewall policies include predefined rules for detecting and controlling PCI-scoped data. See: Hardware and Software Requirements for Branch , Concerto SASE End-to-End Configuration
Peak Burst Size (PBS): The maximum volume of burst traffic, in bytes per second, that a three-color policer allows through an interface; the PBS value must be equal to or greater than the CBS. See: Configure NPU Policy-Based Forwarding , Configure CoS for SD-LAN
Peak Information Rate (PIR): The maximum rate of traffic, in bits or kilobits per second, that a two-rate policer allows through an interface, or that a traffic class or queue may use when spare capacity is available; the PIR must be equal to or greater than the CIR. See: Configure NPU Policy-Based Forwarding , Configure Hierarchical Scheduling
Perfect Forward Secrecy (PFS): A key-exchange property, based on a Diffie-Hellman group, that ensures a compromised long-term key cannot be used to derive past session keys; configurable for both IKE and IPsec security associations on Versa tunnels. See: Configure IPsec VPN Profiles , Configure Site-to-Site Tunnel Interfaces in Concerto
Perl Compatible Regular Expressions (PCRE): The regular-expression syntax used to define custom match patterns in Versa security features such as DLP data patterns and IPS signatures. See: Configure Versa Secure Access Objects , Configure Vulnerability Rules
Personally Identifiable Information (PII): Data that can identify a specific individual, such as names, dates of birth, contact details, or physical descriptors; a primary category of content that DLP predefined patterns are designed to detect. See: DLP Predefined Patterns , DLP Predefined Patterns Quick-Reference
PIM Source-Specific Multicast (PIM-SSM): A PIM mode in which receivers join a specific (source, group) pair rather than any source for a group, building distribution trees rooted at the source; used when the source is known in advance, for a more efficient, scalable, and secure model. See: Multicast , Configure IP Multicast
PIM Sparse Mode (PIM-SM): A PIM mode that forwards multicast traffic toward receivers only after an explicit join request, distributing traffic from a rendezvous point rather than assuming receivers exist; used in Versa SD-WAN multicast deployments built around a hub-and-spoke topology. See: Multicast , Configure IP Multicast
Point of Presence (PoP): A physical or cloud-based access location in a network backbone that hosts infrastructure close to users and applications; the Versa SASE Fabric operates 100+ PoPs that deliver native security services and optimize traffic routing. See: Core Platforms , Networking
Point-to-Point Protocol (PPP): A data-link layer protocol used to establish a direct connection between two network nodes; PPPoE encapsulates PPP frames inside Ethernet frames to extend PPP over an Ethernet network. See: Configure PPPoE Interfaces in Concerto
Point-to-Point Protocol over Ethernet (PPPoE): A protocol, commonly used with DSL services, that encapsulates PPP frames inside Ethernet frames; WAN interfaces using PPPoE authenticate to the service provider with a username and password before establishing the connection. See: Configure Interfaces , Configure PPPoE Interfaces in Concerto
Policing: A QoS technique that rate-limits ingress traffic to a configured peak rate and burst size, preventing an egress port or the device itself from being overloaded; it can be applied at the tenant, policy, or App QoS level. See: QoS
Policy Evaluation: A Versa Director tool that identifies which configured rules match a given set of traffic criteria across policy types such as access, QoS, authentication, decryption, DoS, microsegmentation, PBF, and SD-WAN. See: Use Network Monitoring Tools
Policy-Based Forwarding (PBF): A VOS mechanism that forwards packets according to configured policy rules rather than solely by routing-table lookup, matching traffic on Layer 3 through Layer 7 criteria and steering it to a specified next hop, such as a WAN interface, GRE tunnel, or SD-WAN next hop. See: Configure DNS Proxy with SD-WAN Traffic Steering for DIA , Configure Geolocation Objects
Policy-Based VPN: An IPsec VPN configuration mode in which traffic is selected for encryption based on defined policy rules, such as protocol, source, and destination, rather than routed through a dedicated tunnel interface. See: Configure IPsec Backhaul , Configure WAN Connections
Port Forwarding: A NAT technique, also called port mapping, that redirects incoming packets from an external address-and-port pair to an internal address and port, letting external devices reach services on a specific host inside the LAN. See: Configure CGNAT Policies , Titan Mobile 9.3.0
Port-Based Network Access Control (PNAC): The category of protocol, standardized as IEEE 802.1X, that controls network access on a per-port basis by requiring device authentication before granting access to network resources. See: Configure IEEE 802.1X Device Authentication
Post-Staging Template: A Versa Director device template containing the complete production configuration, including interfaces, routing, tunnels, and services, deployed to a VOS branch device after staging; parameterized variables in the template are bound to device-specific values. See: Bind Parameterized Variables to Values for a Post-Staging Template , Overview of Configuration Templates
Power over Ethernet (PoE): An IEEE standard (802.3af/at/bt) that delivers electrical power over Ethernet data cabling to connected devices such as access points and cameras; CSG and CSX appliances support PoE, PoE+, and PoE++ variants on their copper LAN ports. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Network Interface Cards
Pre-Logon: A Versa SASE Client connection method that authenticates a device and establishes a secure VPN tunnel to the corporate network before the user logs in, allowing new devices with no prior connectivity to reach domain services such as DNS, DHCP, and Active Directory. See: Configure SASE Tenants , Configure Pre-Logon for the Versa SASE Client
Predefined Applications: A Versa-maintained catalog of thousands of internet applications, each assigned a risk level, productivity level, and family classification by the Versa security research team, used to match traffic in QoS, traffic-steering, and security policies. See: Configure Profile Elements , Configure QoS
Prefix List: A named, ordered set of sequences that permit or deny IPv4 or IPv6 route prefixes by address and prefix-length range, used to filter routes in redistribution policies and other routing configuration. See: Configure Virtual Routers
Preshared Key (PSK): A shared secret string configured on both ends of an IKE or IPsec connection to authenticate the peers, used as an alternative to certificate-based (PKI) authentication during device staging and VPN setup. See: Configure a Secure SD-WAN Tenant , Versa Concerto for SD-WAN
Primary Account Number (PAN): The main card number printed on a payment card, detected by the CREDIT_CARD_NUMBER predefined pattern using issuer-specific length and prefix rules for card networks such as Visa, Mastercard, and American Express. See: DLP Predefined Patterns , DLP Predefined Patterns Quick-Reference
Privacy-Enhanced Mail (PEM): A Base64 text encoding for certificates and private keys delimited by BEGIN/END markers; the format accepted when importing CA certificates and key pairs into Versa systems. See: VMS-PAN Integration: HA based VMS , Install and Configure VMS
Private App Protection Rule: A per-tenant firewall rule in Versa SSE, analogous to an internet protection rule, that matches traffic from remote users to an enterprise's custom private applications and applies security enforcement such as IPS, malware protection, and DLP inspection. See: Versa SASE Portal Overview , Concerto SASE End-to-End Configuration
Private Application: A user-defined object representing an internal enterprise application, matched by IP prefix, FQDN, port, and protocol, that is referenced by Real-Time Protection rules on the SASE gateway to allow or block access. See: Step-By-Step Configuration: Versa Secure Private Access (VSPA) , Step-By-Step Configuration Guide for
Private SASE Gateway: A SASE gateway dedicated to a single provider or tenant organization rather than shared across tenants; only an operator can add one, and it can be deployed on dedicated hardware or virtual CSG platforms, including a multitenant variant for managed service providers. See: Add Devices Using Titan Portal , Activate a Private SASE Gateway and Deploy Tenants on a Private SASE Gateway
Pro Net: A Versa licensing tier that provides SD-WAN-controller-based dynamic, encrypted IPsec VPN overlay connectivity with address translation and routing-policy-based traffic steering, targeted at small branches or larger sites with a single circuit per device. See: Sample Use Cases
Profile Element: A reusable Concerto configuration object, such as a policy, policy element, rule, or element, that can be referenced across multiple profiles instead of being redefined for each one. See: Configure Profile Elements , Configure Profiles
Propagation: The Concerto action of updating referencing objects or devices to point to a newer version of a configuration object after it has been edited, so references are not left pointing at the original version. See: Versa Concerto for SD-WAN , Versa Concerto for SD-WAN
Protocol Data Unit (PDU): The unit of data exchanged at a given protocol layer; Versa SLA monitoring exchanges SLA PDUs between sites to measure loss, latency, and jitter. See: Configure Interfaces , Configure Firewalls (NGFW)
Protocol Independent Multicast (PIM): A family of multicast routing protocols that build distribution trees between multicast sources and receivers independent of the underlying unicast routing protocol; VOS supports modes including PIM Sparse Mode, PIM Source-Specific Multicast, and PIM Anycast RP. See: Networking , Multicast
Provider Edge Router (PE): A router in an MPLS or service-provider network at the boundary with a customer site; SD-WAN gateways establish BGP or OSPF sessions with PE routers to exchange routes between the MPLS underlay and the SD-WAN overlay. See: Install on AWS , Install on Azure
Provider Organization: The top-level parent organization in Versa's multitenant model; provider users can be granted access to system-wide resources and, depending on role, administer the entire system across all tenants. See: Install Concerto , Monitor Provider and Tenant Organizations
Proximity: The maximum allowed byte distance between a matched keyword and a matched regular expression for a DLP predefined pattern to fire; typical ranges run from 25 to 200 bytes depending on the pattern. See: DLP Predefined Patterns , DLP Predefined Patterns Quick-Reference
Proxy ARP: A VOS device feature in which the device responds, using its port's physical MAC address, to ARP requests for IP addresses configured in NAT pools within or outside the interface's subnet, reducing Layer 2 broadcast traffic. See: Configure Interfaces
Proxy Auto-Configuration File (PAC): A file that defines how a web browser or other user agent automatically selects the appropriate proxy server for a given URL; VOS devices can host PAC files and distribute them to clients, including Versa SASE clients. See: Consolidated SD-WAN Design Guide , Configure the Versa Secure Access Service (Secure SD-WAN)
Pseudo Tunnel Virtual Interface (PTVI): A statically configured tunnel interface, sourced from a TVI and present on every SD-WAN branch, used for control-plane connections toward Controller nodes so a branch can build its initial tunnels even before it is connected. See: Understand SD-WAN Interface Numbering , Troubleshoot IKE and IPsec
Public Key Infrastructure (PKI): A framework of certificates, certificate authorities, and public/private key pairs used to authenticate devices and secure communications; VOS devices can use PKI-based authentication, as an alternative to a preshared key, during zero-touch provisioning and IKE negotiation. See: Configure a Secure SD-WAN Tenant , Configure AAA
Publish: The Concerto action that applies and commits saved, propagated configuration changes to Versa Director and the target appliances or SASE gateways, making the changes take effect on the network. See: Propagate Configuration Changes to Appliances , Upload Custom CA Certificate, Key File, and CA Chain

Q

Q-in-Q: An IEEE 802.1Q tunneling technique that adds an outer VLAN tag, using TPID 0x88a8, around an inner VLAN tag, letting a service provider separate and transport traffic for customers or enterprises that use overlapping VLAN IDs. See: Configure Interfaces , Configure Q-in-Q Inner VLAN Tagging in Concerto
QoS Profile: A Concerto configuration object that defines ingress policing (peak rate and burst size), the forwarding class and loss priority to assign to matching traffic, and whether to rewrite DSCP or 802.1p header bits. See: Configure QoS , Configure QoS Policies and Rules
Quad Small Form-Factor Pluggable 28 (QSFP28): A quad-lane pluggable transceiver form factor supporting 100-Gigabit Ethernet, used on higher-end CSG and CSX appliances; a QSFP28 port can operate as a single 100-Gigabit port or be split via breakout cables into four lower-speed lanes. See: At a Glance Cloud Services Gateway 5000 Series , At a Glance Cloud Services Gateway 3000 Series
Quality of Experience (QoE): A measure of application performance as experienced by users over a network path, computed from packet loss and color-coded as good, fair, or poor; Versa SD-WAN dashboards show QoE per path and after traffic-steering optimization. See: SD-WAN Dashboards , Manage Custom Reports
Quality of Service (QoS): A set of techniques for classifying, prioritizing, and scheduling network traffic during congestion so that higher-priority traffic is forwarded ahead of lower-priority traffic; also called class of service. See: Analytics Log Collector Log Types Overview , Event Logs
Quarantine: A DLP or CASB enforcement action that sends flagged traffic or files to a customer-provided cloud storage location instead of allowing them to reach their intended destination. See: Configure Data Loss Prevention in Concerto , Configure Offline Data Loss Prevention

R

RAC/RAS: Titan device modes that provide client-based (RAC) or service-based (RAS) remote access VPN connectivity on a multitenant gateway, ordered as an add-on before or after device activation. See: Versa Titan Release Notes for Releases 10.3, 10.3.3, and 10.3.4
Random Early Drop (RED): A congestion-avoidance technique that probabilistically drops packets before a queue is completely full; used in Versa zone-protection flood settings, as an action between Allow and Drop, once traffic reaches a configured rate threshold. See: Zone Protection Profile , Manage Organization Settings
Rapid Spanning Tree Protocol (RSTP): A spanning-tree protocol defined in IEEE 802.1w that speeds reconvergence after a topology change by simplifying port states and how ports transition between them; it is backward compatible with standard STP. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure Layer 2 Forwarding
Real-Time Endpoint Information Profile (RT-EIP): An extension of the Endpoint Information Profile that reports incremental security-posture changes from the Versa SASE client to the gateway every 10 seconds, rather than a full snapshot on a longer interval, enabling rapid posture-drift detection. See: Configure SASE Secure Client-Based Access Rules , Configuring Real-Time Endpoint Information Profiles
Real-Time Monitoring (RTM): A VOS capability that monitors real-time audio, video, and voice flows for quality, working with the AppID engine to intercept RTP/RTCP traffic and compute a Mean Opinion Score used as input to SD-WAN SLA profiles. See: Configuring Realtime Monitoring – MOS Score , Configure Real-Time Monitoring
Real-Time Protection: The Versa SSE policy category that applies security profiles, such as URL filtering, malware protection, IPS, CASB, and DLP, to internet-bound and private-application traffic through Internet Protection and Private App Protection rules. See: Step-By-Step Configuration Guide for , Step-By-Step Configuration Guide for
Real-Time Transport Protocol (RTP): A protocol for delivering real-time audio and video over IP networks; VOS devices intercept RTP packets to extract jitter, loss, and delay information used to calculate a path's MOS score. See: Configure MOS Score Monitoring , Configure SLA Profiles for SD-WAN Traffic Steering
Received Signal Strength Indicator (RSSI): A measurement of total received signal power on a WWAN interface, expressed in dBm, used to classify a modem's cellular signal strength as excellent, good, fair, poor, or no signal. See: Configure WWAN
Recent Acknowledgment (RACK): A TCP loss-detection algorithm that uses time-based heuristics rather than duplicate-acknowledgment counting to detect lost segments; implemented in VOS TCP optimization to improve recovery from reordering and tail drops. See: Configure SD-WAN Traffic Steering , Configure TCP Optimizations
Record Protocol: The TLS sub-protocol that takes messages from the handshake protocol, fragments the data into blocks, protects and transmits the records, and on receipt verifies, decrypts, and reassembles the data for delivery to higher-level clients. See: Configure SD-WAN TLS Decryption , Configure SD-WAN TLS Decryption in Concerto
Redistribution Policy: A routing policy that forwards routes learned by one protocol into another, for example static routes into OSPF or OSPF into BGP, using match conditions such as protocol, prefix, community, and tag, and actions such as accept or reject, metric, and community changes. See: Configure Virtual Routers , VOS Edge Routing Protocols
Region: A Concerto topology grouping of sites used for scalability, management, and role-based access control; a region can be assigned hubs with per-region priority, one or more Director nodes, and optionally its own root domain for SASE gateway FQDN generation. See: Configure Regions , Deploy Lifecycle Overview
Remote Access Server (RAS): An IPsec VPN profile type on a VOS device that terminates remote-access client VPN tunnels, assigning IP addresses from a configured address pool and supporting certificate, preshared-key, or EAP-based peer authentication. See: Configure Virtual Routers , Configure IPsec VPN Profiles
Remote Access VPN (RAV): A VPN service that lets remote users establish a secure tunnel into an enterprise network; on Versa devices it is configured through a remote access server template and requires a WAN port with a static IP address to terminate client connections. See: Configure an Endpoint Client Service (Remote Access VPN) Template , Onboard Versa Cloud NGFW (SaaS) Service License on AWS
Remote Authentication Dial-In User Service (RADIUS): A distributed client-server protocol for authentication, authorization, and accounting in which user credentials are verified against an external server before access is granted to a network, device, or service; supported on VOS devices and Versa Director for administrator and end-user authentication. See: Configure Management Servers , Configure AAA
Remote Browser Isolation (RBI): A security technique that renders web sessions in an isolated remote environment rather than on the endpoint browser, containing web-based threats; offered as a Versa add-on, with activity reported through Analytics and Concerto dashboards. See: Security , Analytics Log Collector Log Types Overview
Remote Collector: A destination system, defined by IP address, port, and transport (TCP, UDP, or TLS), to which the log collector exporter streams locally collected logs in syslog format, such as third-party SIEM systems, Director nodes, or Kafka clusters. See: Configure Log Collectors and Log Exporter Rules , Versa Analytics Configuration Concepts
Remote Desktop Protocol (RDP): A protocol that provides a user with a graphical interface to remotely view and control another computer over a network; supported as a clientless application-access type in Versa Concerto. See: Configure Clientless Applications in Concerto
Rendezvous Point (RP): In PIM sparse mode, the router that serves as the root of a shared multicast distribution tree for a group, receiving source traffic and forwarding it toward members; an RP can be configured statically or learned via Bootstrap Router and Candidate RP. See: Multicast , Configure IP Multicast
Resource Tags: Labels associated with a VOS device in Versa Director that can be used to restrict a user role's visibility to only the tagged devices' data in Director and Analytics dashboards. See: View Analytics Dashboards and Log Screens
Retro Scan: A schedule-based, API-driven data protection scan that inspects objects already at rest in a SaaS or IaaS application, applying policy retroactively to existing content rather than only to events generated as new data arrives. See: Best Practices for CASB Security , Configure API-Based Data Protection Policies for IaaS
Return Material Authorization (RMA): The process of returning a defective appliance or part to the vendor for repair or replacement, requiring an authorization number issued by customer support and an update of the replacement device's serial number in the management platform. See: Update the Serial Number for an RMA Device in Concerto , Subscription Lifecycle
Reusable Object: A Concerto configuration object, such as an address group, application, certificate, profile, or schedule, that can be referenced by multiple other objects or appliances; changes to a reusable object can be propagated to everything that uses it. See: Versa Concerto for SD-WAN , Versa Concerto for SD-WAN
Rewrite Rule: A reusable object that examines a packet's forwarding class and loss priority and rewrites the corresponding DSCP, DSCP IPv6, or IEEE 802.1p header bits on outbound packets. See: Configure Reusable Objects
Rivest-Shamir-Adleman (RSA): A public-key cryptographic algorithm selectable as a TLS key-exchange algorithm, alongside ECDHE, for connections supporting TLS versions earlier than 1.3, with a configurable minimum supported key length. See: Configure SD-WAN TLS Decryption , Configure SD-WAN TLS Decryption in Concerto
Role-Based Access Control (RBAC): An access-control model that grants permissions based on assigned user roles; Versa Director and Analytics use RBAC, including resource tags, to restrict a user's access to the tenant resources, devices, and dashboards they are authorized to view. See: Troubleshoot Analytics Access and Certificate Issues , View Analytics Dashboards and Log Screens
Root Domain: A domain name configured at the service-provider or region level that Concerto uses to automatically generate SASE/SSE gateway FQDNs for a tenant and its child tenants; a region-specific root domain overrides the parent tenant's. See: Configure the Root Domain for a SASE Deployment , Configure Regions
Round-Trip Time (RTT): The time for a packet to reach a destination and return; collected by Versa SLA monitoring as a path-quality metric alongside loss and jitter, and used in traffic-steering decisions. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure the Versa Secure Access Service
Route Distinguisher (RD): A BGP/MPLS-VPN value attached to a route to make otherwise-identical prefixes from different sites or VRFs unique in MP-BGP; configuring a unique RD per CPE in a dual-homed branch improves best-path convergence and simplifies troubleshooting. See: VOS Edge Routing Protocols , Using OSPF for Dual Site HA
Route Leaking: Resolving a static route's next hop through a different routing instance than the one in which the route is configured, for example resolving a LAN route's next hop through the transport virtual router. See: VOS Edge Routing Protocols
Route Redistribution: The exchange of routing information between different routing protocols or routing domains; on Concerto, redistribution behavior is based on the device's role, such as hub, spoke, or controller. See: Configure SD-WAN WAN-Facing Routing Protocols
Route Reflector: A BGP router that reflects routes between its client peers so a full iBGP mesh is not required; Versa SD-WAN Controller nodes act as route reflectors for CPE branches, reflecting routes and security-association information per tenant. See: VOS Edge Routing Protocols , Using OSPF for Dual Site HA
Route Target (RT): A BGP extended community attribute used to control which routes are imported into a given VRF, used in Versa SD-WAN topologies such as spoke-to-spoke-via-hub to select hub-advertised spoke routes. See: Versa SD-WAN Design Guide
Routing Information Base (RIB): The table in which a router stores routes learned from all sources and, after policy evaluation, selects the best paths to install for forwarding; BGP advertises its permitted best paths from its RIB to peers. See: Understanding, Configuring, and Troubleshooting BGP Conditional Advertisement , VOS Edge Routing Protocols
Routing Information Protocol (RIP): A legacy distance-vector interior gateway protocol that uses hop count as its metric, limiting paths to a maximum of 15 hops; supported by Versa VOS for legacy routing environments alongside OSPF and BGP. See: Networking , Configure Virtual Routers
Routing Information Protocol version 2 (RIPv2): A distance-vector interior gateway protocol supported on VOS devices for LAN and WAN-facing route exchange, configurable with MD5 or simple-password authentication and BFD-based liveness detection. See: Configure SD-WAN Topology and LAN Routing Protocols , Configure SD-WAN WAN-Facing Routing Protocols
Routing Instance: A named, reusable forwarding context that a VOS device uses to reach a destination, referenced when configuring interfaces, monitors, and DHCP and SaaS application monitor profiles. See: Configure Reusable Objects , Configure SaaS Application Monitoring
RTP Control Protocol (RTCP): A companion protocol to RTP that carries sender and receiver reports containing statistics about the quality of a real-time voice or video stream; VOS devices use RTCP together with RTP to calculate MOS scores. See: Configure MOS Score Monitoring , Configure SLA Profiles for SD-WAN Traffic Steering

S

SaaS Application Monitor: A reusable VOS monitor object that sends HTTP, ICMP, or TCP probes to measure the responsiveness of a SaaS application or destination, collecting performance metrics used by SLA and SD-WAN forwarding profiles to select the best path. See: Configure SaaS Application Monitoring , Configure SaaS Application Monitors
SaaS Tenant Control: A CASB capability that restricts access to a SaaS application, such as Office 365, to an organization's approved corporate tenant by inserting identifying HTTP headers, blocking logins to personal accounts or other organizations' tenants to prevent data leakage. See: Best Practices for CASB Security , Step-By-Step Configuration:
Safe Search: A search-engine setting, enforceable network-wide by overriding DNS with a CNAME, that filters mature or inappropriate content from Google, Bing, and YouTube search results. See: Configure Safe Search
SAML Profile: A Versa configuration object that holds the SAML settings for an identity provider; it is referenced by an authentication profile so a device or service can perform SAML-based sign-on. See: Enable SAML Authentication
Sandboxing: The technique of executing a file in an isolated environment to observe its behavior and detect malware, including zero-day threats that signature-based scanning would miss; ATP uses cloud multi-sandboxing and reports a verdict such as clean, suspicious, or malicious. See: Manage ATP File Reports , Flow Logs
SASE Client: Also called the Versa SASE Client: a cross-platform client application that provides Zero Trust connectivity and security for users and devices, with best-path routing and dynamic policy enforcement based on identity, device posture, and continuously evaluated context. See: Core Platforms , Security
SASE Fabric: Versa's globally distributed backbone of SASE gateways, points of presence, and orchestration components that delivers a traffic-engineered, full-mesh network with native security services at every edge, routing traffic through the nearest PoP instead of backhauling it. See: Core Platforms , Networking
SASE for SIM: A Versa capability that authenticates and authorizes SIM-enabled IoT and mobile devices on 2G through 5G networks using their IMSI, providing clientless, Zero Trust SASE connectivity without requiring a software client on the device. See: Secure Access Dashboards , Enable and Configure VMS Services
SASE Gateway: A cloud-hosted or customer-deployed Versa gateway that terminates remote-user and site-to-site tunnels, enforces security policy such as TLS decryption, antivirus, IPS, and URL filtering, and brokers access between SASE clients and private or internet destinations. See: Configure Threat Intelligence from VMS , Configure VMS to Integrate EDR Platforms
SASE Portal: A registration and policy-distribution service that authenticates a Versa SASE client user on first connection and pushes configuration, policies, and the list of available SASE gateways, including the gateway root CA certificate, to the client. See: Secure Communication for SD-WAN Devices and SASE Clients , Configure the Versa Secure Access Service (NGFW)
Scalable Group Tag (SGT): A numeric label, valued 0 through 4094, assigned to traffic sources and distributed through an SD-LAN network to classify traffic and enforce microsegmentation and access-control policies in NPU ACL and NGFW rules. See: Configure Microsegmentation for SD-LAN , Configure CWA Redirect Authentication for SD-LAN
Schedule Object: A tenant-scoped reusable object that limits when a security policy rule is in effect, matching either a fixed date/time range or a recurring daily or weekly schedule. See: Configure Schedule Objects , Configure Reusable Objects
SD-LAN: The secure local-area-networking component of the VersaONE Universal SASE platform, integrated alongside SD-WAN, NGFW, SASE, and SSE to securely connect users, devices, workloads, and networks. See: Integrate Versa Analytics and CrowdStrike NG-SIEM
SD-Security: A multitenant, software-only security solution offering fully integrated, layered security services that can be deployed anywhere in a Versa SD-WAN, at the branch, cloud, or data center, and managed centrally. See: Solution Use Cases
SD-WAN: A networking approach that decouples the control plane from the underlying physical transport, using dynamic traffic steering and application-aware routing to build encrypted virtual overlays across diverse WAN links such as internet, MPLS, and LTE. See: Configure SaaS Application Monitoring , Configure SD-WAN Access Control Policies
SD-WAN Controller Node: A Versa node that acts as an MP-BGP route reflector for SD-WAN branches and hubs, distributing routing information and topology attributes among devices and maintaining secure control-plane connections with each one. See: Understand SD-WAN Interface Numbering , Troubleshoot SD-WAN Branches
SD-WAN Forwarding Profile: A configuration object that defines WAN path priorities, connection method, load-balancing behavior, and associated SLA profiles for traffic matched by an SD-WAN policy rule, with options such as packet replication, forward error correction, and automatic session re-evaluation on failover. See: DIA Traffic Steering and Session Re-evaluation (QoE) , Explicit Web Proxy with SD-WAN Traffic Steering
SD-WAN Gateway: A VOS instance that interconnects an SD-WAN VPN domain with a non-SD-WAN domain, such as a legacy MPLS Layer 3 VPN, a disjointed underlay, or the internet, typically by exchanging routing information via BGP. See: Install on Google Cloud Platform , SD-WAN Solution Architecture
SD-WAN Overlay: The set of tunnels Versa SD-WAN builds between branches to abstract the underlying transport networks. Two overlay networks are built by default: an encrypted overlay using IPsec and a plain-text overlay using VXLAN. See: Versa SD-WAN Design Guide
SD-WAN Policy: An ordered set of rules on a VOS device that matches traffic by criteria such as IP headers, applications, or URLs and references a forwarding profile that determines how matched traffic is steered; unmatched traffic receives default behavior. See: SD-WAN Traffic Optimization , Configure App Based Traffic Steering over Secure SD-WAN Gateway
SD-WAN Traffic Steering: The VOS mechanism that directs traffic flows across available WAN links by matching traffic to a forwarding profile listing candidate paths and an SLA profile defining performance thresholds, adjusting path selection in response to real-time link degradation. See: Configure SD-WAN Traffic Steering , Configure SD-WAN Traffic Steering
Search Node: One of the three Versa Analytics node personalities (analytics, search, forwarder) and one of its two database (datastore) personalities; it stores per-event logging data such as alarms and drives log-table and log-screen views. Its sizing depends on which features have logging enabled and their retention period. See: Versa SD-WAN Design Guide
Secure Access Gateway: The Versa Secure Access Service component that a SASE client connects to after registering with the secure access portal, terminating the VPN tunnel, authenticating users, and enforcing gateway-level security and access policies. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure the Versa Secure Access Service
Secure Access Gateway Profile: A Versa Director configuration object associated with SASE clients that controls gateway-side behaviors such as split tunneling, always-on connectivity, tamper protection, DLP data exfiltration, and automatic software updates. See: Use the Versa SASE Client Application , Use the Versa SASE Client with Concerto
Secure Access Portal: The Versa Secure Access Service component through which end users register their SASE client; it authenticates users locally or via LDAP with optional two-factor authentication and pushes configuration such as policies, routes, DNS resolvers, and a gateway list during registration. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure Digital Experience Monitoring
Secure Access Service Edge (SASE): A converged architecture that combines SD-WAN connectivity with cloud-delivered security services such as CASB, DLP, and firewall, delivered to users and sites through client software and gateways; it underlies Versa's secure access solutions such as VSPA and VSIA. See: Best Practices for CASB Security , Introduction
Secure Client Access (SCA): The Versa SSE policy category, also called Client-based Access, that governs how the SASE client connects to a gateway, matching users, groups, endpoint posture, and geolocation to actions such as tunnel allow, deny, or Direct Internet Access bypass. See: Troubleshoot Endpoint Information Profiles , Enforce OS-Based Secure Access Policy Rules for Remote SASE Clients
Secure Client Access Profile: A Concerto configuration object bound to SASE clients that defines connection settings such as DNS resolvers, private routes, application monitors, split tunneling, and Digital Experience Monitoring applied to a remote user's session. See: Configure SASE Secure Client Access Profiles in Release 12.1.1 , Configure SASE Secure Client-Based Access Profiles
Secure Client Access Rule: A Concerto policy that determines whether and how an end-user device may connect to a SASE gateway, matching users, groups, operating system, endpoint posture, and source location to enforce traffic action, gateway selection, and client configuration. See: Step-By-Step Configuration: Versa Secure Internet Access (VSIA) , Step-By-Step Configuration Guide for VSPA and VSIA
Secure Hash Algorithm (SHA): A family of cryptographic hash functions (SHA-1, SHA-256, and larger variants) used for integrity verification and authentication in IPsec, TLS, and certificate operations. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Configure the Versa Secure Access Service
Secure Mode: A hardened operating mode for VOS, Director, and Analytics nodes that applies Center for Internet Security (CIS) benchmark configurations to core Linux OS components; enabling it requires an OS security package and centralized authentication to be configured first. See: Perform Manual Hardening for Versa Analytics , Enable Secure Mode
Secure SD-LAN: Versa's software-defined LAN architecture that unifies switching, routing, and security for campus and branch networks, delivering Zero Trust access control, microsegmentation, and integrated security (NGFW, IPS, UTM) across secure switches, WLAN access points, and ZT-LAN appliances. See: Networking , Core Platforms
Secure SD-NIC: A Versa solution that extends the security perimeter into compute devices by running VOS at the server or device level, enabling ZTNA, adaptive microsegmentation, and inline traffic inspection for multi-tenant data centers and untrusted environments. See: Networking
Secure SD-WAN: Also Versa Secure SD-WAN: Versa's networking solution that integrates software-defined WAN with advanced security in a single platform, providing carrier-grade routing, built-in NGFW, IDS/IPS, and ATP, and application-aware traffic optimization. See: Networking , Core Platforms
Secure Shell (SSH): A cryptographic network protocol for securely accessing and operating a remote computer or device over an untrusted network, typically used for command-line administration and key-based, password-less file transfer. See: Configure Clientless Applications in Concerto , Use the VSync Tool (NGFW)
Secure Sockets Layer (SSL): A protocol for encrypting network communications, used together with certificate authority certificates to secure data transfer between web servers and clients. See: Upload Custom CA Certificate, Key File, and CA Chain , Kafka SASL SSL Support in Concerto
Secure Web Gateway (SWG): A security service that inspects and controls user traffic to the internet, enforcing policies such as SSL/TLS decryption, URL filtering, DNS filtering, and file filtering; one of the services consolidated within Versa Secure Internet Access. See: Best Practices for CASB Security , Security
Security Access Policy: An ordered set of stateful firewall rules, each with match criteria such as IP headers, zones, addresses, geolocation, services, or time of day and an allow, deny, or reject action, evaluated in order until the first match applies. See: Configure Stateful Firewall , Configure Stateful Firewall (NGFW)
Security Action: A reusable object that defines the response, such as allow, block, reset, ask, justify, or sinkhole, taken when traffic matches a security policy, across categories including decryption, DNS, IPS, IP filtering, and URL filtering. See: Configure Reusable Objects , Configure SD-WAN DNS-Filtering Profiles
Security Assertion Markup Language (SAML): An open XML-based standard for exchanging authentication and authorization data between an identity provider and service providers, most commonly used for web browser-based single sign-on so users authenticate once and access multiple applications. See: Configure Single Sign-On for Concerto , Configure Single Sign-On Using Director
Security Association (SA): The negotiated set of security parameters, such as keys, algorithms, and lifetimes, between two IPsec peers that governs how traffic on a tunnel is protected. See: SD-WAN Solution Architecture , Solution Architecture
Security Group: A virtual firewall in AWS that controls inbound and outbound traffic to and from EC2 instances within a VPC by defining rules for allowed protocols and ports. See: Versa Networks SASE Gateway Integration with AWS Cloud
Security Information and Event Management (SIEM): A category of systems that aggregate, correlate, and analyze security event and log data from multiple sources for threat detection, monitoring, and compliance reporting; VOS devices and Versa Analytics can stream logs to third-party SIEM platforms. See: Best Practices for CASB Security , Core Platforms
Security Package (SPack): A regularly updated content package from the Versa security research team that delivers security data, such as IPS/IDP signatures, URL categories and reputation data, DLP predefined patterns, and IoT security objects, to Versa devices; SPacks can be configured to auto-update. See: Use SPacks with Concerto , Use OS SPacks with Concerto
Security Parameter Index (SPI): An IPsec identifier for a security association; when an SPI is rekeyed, SD-WAN header compression's flow-learning state is cleared and restarted from the beginning. See: Configure SD-WAN Header Compression
Security Profile Group: A named object that combines two or more security profiles, such as IP filtering, file filtering, antivirus, URL filtering, vulnerability, and DNS filtering profiles, into a single group that can be applied to one or more security rules. See: Configure Security Profile Groups , Configure Security Profile Groups (NGFW)
Security Service Edge (SSE): The cloud-delivered security component of a SASE architecture, comprising services such as ZTNA, SWG, CASB, and DLP that protect access to the internet, SaaS, and private applications, enforced through SSE gateways. See: Best Practices for CASB Security , Networking
Security Zone: A grouping of network interfaces, tunnels, or traffic sources that share identical security requirements, letting a single security policy apply to all members; used as source and destination match criteria in firewall and steering rules. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
Service Chain: A configuration object that defines an ordered sequence of network services or service node groups through which traffic is directed, such as chaining third-party VNFs to a VOS device via a service-chain template. See: Director GUI Overview , Configure Service Chains
Service Chaining: A technique for directing traffic through an ordered sequence of virtual or physical network service functions before it reaches its destination; VOS devices support native service chains as well as chaining to third-party VNFs and physical network functions. See: Versa Integrated Web Application Firewall , Features and Capabilities
Service Group: A reusable object that combines multiple service objects into a single group to simplify policy configuration in firewall and other security rules. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
Service Node: A VOS instance role within an Elastic Services Cluster dedicated to CPU-intensive stateful services such as TLS termination, NGFW, UTM, antivirus, IPS, CASB, and DLP. See: Versa Networks Elastic Services Cluster
Service Node Group (SNG): A logical grouping of service chains or network services on a VOS device, with associated policies and quotas, that determines which services are hosted for an organization and lets different applications receive different combinations of network functions. See: Configure Service Node Groups , Configure Service Chains
Service Object: A reusable object, predefined by Versa Networks or custom-created per tenant, that defines traffic match criteria based on protocol name or number and source or destination port, referenced by security policies. See: Configure Service Objects , Configure Reusable Objects
Service Principal Name (SPN): A unique identifier, in the form service/hostname, for a Kerberos service instance; it is associated with a domain user account and referenced by a Kerberos profile to authenticate the service. See: Configure Kerberos Authentication , Configure Kerberos Authentication (NGFW)
Service Provider (SP): In SAML authentication, the role that consumes an identity provider's assertions to grant a user access to a protected resource; a Versa SSE Gateway acts as the service provider, identified by an SP entity ID and assertion consumer service URL. See: Configure Application Reverse Proxy , Configuring Authentication Profiles on the SSE Gateway
Service Set Identifier (SSID): The name broadcast by a wireless access point that identifies a WLAN and that client devices use to discover and connect to it. See: Configure LAN Interfaces in Concerto
Service Template: A service-specific configuration, such as QoS or NGFW, applied on top of device templates or device groups in Versa Director or Titan to enable a defined set of services, reusable across multiple templates, organizations, and devices. See: Director GUI Overview , Overview of Configuration Templates
Service-Level Agreement (SLA): A set of path-performance thresholds, such as latency, jitter, and packet loss, monitored on SD-WAN links; violation events are logged, and traffic steering can move flows from a non-compliant path to a compliant one. See: Event Logs , Analytics Log Collector Log Types Overview
Session Initiation Protocol (SIP): A signaling protocol for establishing voice and multimedia sessions; VOS includes a SIP application-layer gateway so SIP sessions traverse NAT and firewall policy correctly. See: Configure Application Layer Gateway , Configure Intrusion Detection and Prevention (NGFW)
Session Traversal Utilities for NAT (STUN): A protocol that Versa SD-WAN branches, acting as STUN clients, use to discover the NAT-translated public address that the Controller node, acting as STUN server, sees for each WAN interface, enabling NAT traversal for tunnel establishment. See: NAT Traversal , Troubleshoot SD-WAN Branches
SFP28: A transceiver form factor supporting 25-Gigabit Ethernet, available in short-reach and long-reach optical variants, used on Versa CSG and CSX appliance high-speed fiber interfaces. See: Validated SFPs and Cables for CSX8000 Series Appliances , Validated SFPs and Cables for CSG3000 Series Appliances
Shadow IT: Applications and cloud services used within an organization without explicit IT approval or visibility; CASB solutions discover such usage and can allow, deny, or restrict access based on risk level and activity. See: Best Practices for CASB Security , Security
Shadow IT Discovery: A Versa Concerto capability that identifies SaaS applications observed in an organization's traffic, rates them by risk or confidence score, and lets administrators classify each as Sanctioned, Unsanctioned, Allowed, or Unknown for use in policy rules. See: Best Practices for CASB Security , View Concerto Security Dashboards
Shared Control Plane (SCP): A multitenancy option in which a tenant organization shares its control (management) VR routing instance and IPsec tunnels to Controller nodes with its parent organization, instead of maintaining its own. See: Configure Basic Features
Signature-Based Detection: An intrusion-detection method that compares software or application traffic patterns against a database of known attack signatures to identify malicious activity. See: Configure SD-WAN IPS Profiles , Configure SD-WAN IPS-Filtering Policies
Simple Authentication and Security Layer (SASL): A framework for adding authentication to connection-based network protocols, supporting mechanisms such as SCRAM and OAuth bearer tokens; Concerto and VMS use SASL with SSL to authenticate and encrypt Kafka connections. See: Kafka SASL SSL Support in Concerto , Configure VMS to Integrate EDR Platforms
Simple Certificate Enrollment Protocol (SCEP): A protocol that automates certificate enrollment and renewal between network devices and a certificate authority, letting a VOS device request and retrieve certificates from a CA server such as Microsoft's Network Device Enrollment Service. See: Configure a Secure SD-WAN Tenant , Configure Certificate Servers
Simple Mail Transfer Protocol (SMTP): The protocol used to send email. Versa Director, Analytics clusters, and aggregator nodes are configured with an SMTP server to send alarm notifications, reports, registration codes, and other email alerts. See: Configure Analytics Aggregator Nodes , Configure Analytics Alarms
Simple Network Management Protocol (SNMP): An open standard protocol for managing and monitoring network devices on LANs and WANs; Versa devices support SNMPv2 and SNMPv3 profiles, communities, USM users, and VACM views so external servers can poll them or receive traps. See: Configure Management Servers , Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)
Single Pane of Glass: A Director GUI design approach that lets an administrator configure and monitor individual devices and interfaces, groups of devices for tenants, provider organizations, and an entire SD-WAN/SASE network from one interface. See: Director GUI Overview , Director GUI Overview (for Releases 21.2 and Earlier)
Single Sign-On (SSO): An authentication model in which a user logs in once and gains access to multiple services and applications without re-authenticating to each one, commonly implemented via SAML; Versa Director supports SAML- and OpenID-based SSO. See: Configure Single Sign-On for Concerto , Configure Single Sign-On Using Director
Single-Pass Processing: An architectural principle in which each packet is evaluated once by a single engine across multiple integrated networking and security functions, rather than being chained through separate engines, reducing latency in a converged SASE architecture. See: Networking
Single-Root I/O Virtualization (SR-IOV): A hardware virtualization technology that lets a single physical NIC present multiple virtual functions directly to virtual machines; VOS supports it on select Intel NICs, and it is recommended for Versa headend VMs to maximize network I/O performance. See: Hardware and Software Requirements for Headend , Hardware and Software Requirements for Branch
Site: A Concerto object representing a physical location of a provider or customer, defined with a region, address, and associated Director and Controller nodes, to which appliances, hubs, or hub controllers and a main template are attached. See: Deploy Lifecycle Overview , Configure Appliances, Hubs, and Hub–Controllers
Site of Origin (SoO): A BGP extended community string, derived from a site's unique overlay endpoint address, attached to routes to identify the originating site; used for per-site reachability in SD-WAN traffic engineering and for return-traffic decisions while an SLA monitoring path is rebuilt. See: Configure Data-Driven SLA Monitoring , Configure SD-WAN Traffic Engineering
Site-to-Site Tunnel (S2S): An IPsec or GRE tunnel connecting a Versa SASE gateway or VOS device to a peer such as an enterprise data center, cloud VPC/VNet gateway, or third-party device, carrying private-application and integration traffic; redundant tunnels with BGP are recommended for high availability. See: Versa SASE Portal Overview , Versa Security Service Edge (SSE) – Site to Site Tunnel Configuration via API
SLA Monitoring (SLAM): The VOS mechanism that measures per-path performance between SD-WAN devices, including delay, jitter, and packet loss, using request-response probes in continuous, adaptive, or data-driven modes, feeding path health data to traffic-steering decisions. See: Configure SLA Monitoring for SD-WAN Traffic Steering , Configure SLA Profiles for SD-WAN Traffic Steering
SLA Path: A monitored path, tracked per forwarding class between an SD-WAN branch and another branch or controller, whose up/down state and real-time performance determine availability for SD-WAN traffic steering. See: Monitor VOS Devices in Real Time , Monitor Provider and Tenant Organizations
SLA Profile: A configuration object that defines the link-performance thresholds, such as latency, jitter, packet loss, circuit utilization, and MOS score, that a forwarding profile uses to determine which WAN paths are compliant and eligible to carry traffic. See: Consolidated SD-WAN Design Guide , SD-WAN Traffic Optimization
Small Form-factor Pluggable (SFP): A compact, hot-swappable optical or copper transceiver module standard used in Versa CSG and CSX appliance network ports for 1-Gigabit Ethernet connectivity; higher-speed variants include SFP+, SFP28, and QSFP28. See: CSG1000 Series Hardware Guide , CSG2500 Hardware Guide
Small Form-factor Pluggable Plus (SFP+): An SFP transceiver variant supporting 10-Gigabit Ethernet, available in short-reach (SR), long-reach (LR), and copper-optic types, used on LAN and WAN fiber and copper interfaces of Versa CSG and CSX appliances. See: Validated SFPs and Cables for CSX8000 Series Appliances , Validated SFPs and Cables for CSG3000 Series Appliances
SNAT Pool: A configured pool of source IP addresses, or set of egress networks, that a VOS device uses when performing source NAT for outbound sessions such as DNS proxy requests and cloud lookup requests for URL categorization or file filtering. See: Configure a DNS Proxy , Configure SNAT Pools
SNMP Trap: An unacknowledged SNMP notification sent from a monitored device to an SNMP manager to communicate health and performance warnings; because it is unacknowledged, a trap can be lost if a transmission problem occurs. See: Configure SNMP
Social Security Number (SSN): A 9-digit US government identification number, structured as AAA-GG-SSSS, used as a personal identifier and detected by DLP as a high-sensitivity PII pattern. See: DLP Predefined Patterns , DLP Predefined Patterns Quick-Reference
Software as a Service (SaaS): A cloud delivery model in which applications such as Microsoft 365, Salesforce, and Google Workspace are hosted by a provider and accessed over the internet rather than installed locally; Versa CASB and DLP secure user interactions with these applications. See: View Concerto Security Dashboards , View Analytics Logs Using Concerto
Software-Defined Perimeter (SDP): A security architecture that hides network resources from unauthorized users and grants access only after identity and device verification; delivered by CSX appliances as part of their Secure SD-LAN function. See: Infrastructure , ZT-LAN Overview
Software-Defined WAN (SD-WAN): A WAN architecture that uses software-based control, dynamic encrypted overlay tunnels, and application-aware traffic steering to connect sites across multiple transport links, such as MPLS, broadband, and LTE, under centralized orchestration. See: Networking , Core Platforms
Solution Tier: A licensing tier assigned to a tenant, template, or device subscription that determines the entitled feature set and bandwidth, with SD-WAN and NGFW tier families that can be upgraded, downgraded, or paired with add-on tiers. See: Configure a Secure SD-WAN Tenant , Configure Main Templates
Source NAT (SNAT): A network address translation method that rewrites a session's source IP address, drawn from a configured pool or interface address, used on VOS devices for outbound requests such as cloud lookups and proxied DNS sessions and to keep return traffic symmetric. See: Configure SNAT Pools , Configure Cloud URL Lookup
Southbound Interface: A gRPC-based VMS interface that lets branches or gateways subscribe to and stream data to and from VMS, and that forwards logs and exceptions to Versa Analytics nodes. See: Install and Configure VMS
Spanning Tree Protocol (STP): A Layer 2 protocol, defined in IEEE 802.1D, that prevents loops in a switched network by selectively blocking redundant paths between switches; Versa supports classic STP along with its Rapid (RSTP) and Multiple (MSTP) variants. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure Layer 2 Forwarding
Speed Test: A built-in VOS capability that measures real-time bandwidth between two VOS devices, one acting as speed-test client and the other as server, unencapsulated by SD-WAN overhead; results gauge underlay performance and drive automatic bandwidth-aware traffic steering. See: Traffic Steering with Active Bandwidth Measurement , Troubleshoot Link Bandwidth Issues
Split DNS: A Versa SASE client setting that sends DNS requests for configured private domains over the SASE tunnel for resolution by an enterprise DNS server while breaking out the remaining DNS requests directly to the internet. See: Configure DNS Proxy with SD-WAN Traffic Steering for DIA , Configure the Versa Secure Access Service (Secure SD-WAN)
Split Tunneling: A traffic-routing mode in which only selected traffic, by application, domain, or IP prefix, is sent through a secure tunnel while the rest breaks out directly to its destination, avoiding backhaul of internet-bound traffic. See: Workflow-Based Split Tunnel Options Explained , Core Platforms
Split-Brain: A high-availability failure condition in which both nodes of a redundant pair, such as two Director nodes, simultaneously assume the active role; resolving it requires manual reconfiguration from the node holding the latest configuration. See: Versa Director Issues
Split-Horizon Filtering: An EVPN loop-prevention mechanism in which a non-designated-forwarder device tags forwarded BUM packets with a split-horizon label so the designated forwarder for the Ethernet segment drops them instead of relaying them back to the originating host. See: Configure EVPN Multihoming for Hosts Using ZT-LAN , Configure EVPN Multihoming for SD-WAN
Spoke: A branch-site VOS device in a hub-and-spoke topology that connects to at least one hub; it can combine locally collected performance metrics with metrics exported from hubs to select the best path to an application. See: Configure SaaS Application Monitoring , Configure SD-WAN Hubs
Spoke Group: A Versa Director construct that groups spoke (branch) devices sharing the same connectivity behavior toward a hub, such as spoke-to-hub-only, spoke-to-spoke-via-hub, or spoke-to-spoke-direct, controlling route advertisement and hub preference in hub-and-spoke deployments. See: Configure Spoke Groups , Director GUI Overview
Spoke-Hub-Hub-Spoke Topology (SHHS): A hierarchical Versa SD-WAN topology, also called regional mesh, in which hub and branch devices are grouped by region; branches within a region communicate using any topology, while inter-region traffic transits interconnected regional hubs. See: Consolidated SD-WAN Design Guide , Solution Architecture
SSE Gateway: The Versa Security Service Edge enforcement point, Versa-hosted or on-premises, that terminates SASE client connections and site-to-site tunnels and enforces authentication, TLS decryption, threat protection, and access policies for internet-bound and private-application traffic. See: Best Practices for CASB Security , Deploy an SSE Gateway and Onboard Tenants Using Concerto
SSL Decryption: Decryption of encrypted SSL/TLS traffic so that security services can inspect its contents; Versa security actions let administrators bypass decryption for specific matching traffic, such as trusted websites. See: Configure Profile Elements
SSL Forward Proxy: A transparent TLS decryption mode in which a device acts as a server toward the client and a client toward the server, decrypting, inspecting, and re-encrypting traffic per a decryption policy without either endpoint being aware of the proxy. See: Configure Security , Configure Security
SSL Full Proxy: A TLS decryption mode, operating explicitly or transparently, in which the proxy terminates the client's SSL/TLS session and originates a separate connection to the destination server after applying a decryption policy. See: Configure Security , Configure Security
SSL VPN: A Versa proprietary VPN protocol, based on TLS and DTLS, that lets remote users connect to Versa gateways with the SASE client, typically over port 443; it complements or replaces IPsec and suits restrictive networks where IPsec is blocked. See: Configure SASE Secure Client-Based Access Rules , Configure SSL VPN Profiles
Staging Controller: An optional headend component that new devices connect to during zero-touch provisioning before being redirected to receive their production configuration. See: Hardware and Software Requirements for Headend , Director GUI Overview
Staging Template: A minimal Versa Director device template, supporting WAN interfaces and a limited feature set, that gives a device basic connectivity to the SD-WAN Controller, typically via the Versa global ZTP server, before its post-staging production configuration is applied. See: Director GUI Overview , Director GUI Overview (for Releases 21.2 and Earlier)
Stateful Firewall (SFW): A firewall that tracks the state of active network connections in a session table, verifying Layer 2 through Layer 4 packet information against established sessions and applying allow, deny, or reject actions; offered on VOS as an alternative to NGFW. See: Configure Multitenancy , Configure Stateful Firewall
Stateless Address Autoconfiguration (SLAAC): An IPv6 mechanism that lets a host automatically configure its own IPv6 address from router advertisements without requiring a DHCPv6 server. See: Configure Interfaces , Configure IPv6 on Concerto
Static Route: A manually configured route to a destination network with a defined next hop; on VOS devices it can carry liveness monitors (ICMP, DNS, TCP, or BFD), a metric, a preference, and discard, reject, or no-install data-plane actions. See: Configure Virtual Routers , VOS Edge Routing Protocols
Store Administrator: A Titan Portal role, created by an operator, that creates MSP and reseller accounts, selects which products those MSPs can order, and manages customer organizations and services; it sits above MSP in Titan's account hierarchy. See: Titan Portal 9.1.1 , Add SASE Gateway Devices
Subject Alternative Name (SAN): A certificate extension listing additional identities, host names or IP addresses, that the certificate is valid for; modern TLS validation matches SAN entries rather than the Common Name. See: Install and Configure VMS , Configure DNS Proxy with SD-WAN Traffic Steering for DIA
Subjugation: The process by which a VOS device registers under the management of a Versa Director node via a managed Netconf session, ending its default 45-day unmanaged trial period; an unsubjugated device raises a software-key alarm and is later capped at 30 concurrent sessions. See: Configure Systemwide Functions , VOS Device License and Subjugation FAQs
Subprofile: A component of a Concerto master profile, of type Application, Device, Network Services, Security, Topology, or System, that groups the policies configuring a specific area of appliance behavior and can be reused across multiple master profiles. See: Versa Concerto for SD-WAN , Configure Management Servers
Subtenant: A child tenant nested under a parent tenant in Versa's multitenant model, typically representing a service-provider customer or enterprise division; it can inherit reusable configuration objects, roles, and SASE region and gateway assignments from its parent. See: Versa Concerto for SD-WAN , Configure a Secure SD-WAN Tenant
Surge Protection Device (SPD): A device, specified per IEC standard 61643-11, that protects appliances from electrical surges and spikes by limiting the voltage supplied to connected equipment and short-circuiting transient energy to ground. See: Surge Protection for WAN Lines
SYN Cookies: A TCP SYN flood mitigation technique in which a device generates a cryptographic acknowledgment so connections are not dropped during a flood; it is the default enforcement action for TCP flood protection in DoS protection profiles. See: Configure SD-WAN DoS Protection Profiles , Configure DoS Protection
Syslog: A standard protocol and message format for forwarding log messages, identified by facility and severity as defined in RFC 5424, to a centralized server; Versa Analytics nodes and VOS devices export logs in syslog format to external servers. See: Export Analytics System Logs to a Syslog Server , Analytics Log Collector Log Types Overview
System for Cross-domain Identity Management (SCIM): A standard for automatically provisioning and synchronizing user and group accounts from identity providers, such as Microsoft Entra, Okta, and Ping Identity, into a downstream service; Versa SASE uses it to keep users and groups current for policy association. See: Enable and Configure VMS Services , Install and Configure VMS
System Hardening: The set of recommended procedures, such as disabling unused interfaces, enforcing signed certificates, and restricting management access, applied to a device to ensure it operates securely in a customer network. See: Perform Manual Hardening for Versa Branches, Controllers, and Hubs

T

TACACS+: A centralized authentication, authorization, and accounting (AAA) protocol that VOS devices, Versa Director, and Versa Analytics can use for administrator login, with user-group attributes controlling read/write or read-only access. See: Configure TACACS+ , Perform Manual Hardening for Versa Analytics
Tamper Protection: A Versa SASE client control, enabled on the gateway profile, that prevents users from uninstalling the client, deleting the client account, or removing installation files unless an override key or administrator-generated OTP is provided. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Concerto SASE End-to-End Configuration
TCP Optimization: A Versa feature that mitigates the effects of high latency and packet loss on TCP-based applications by proxying TCP connections at VOS devices, with selectable modes including auto, bypass, forward proxy, proxy, reverse proxy, and splice. See: Configure Profile Elements , Configure SD-WAN Policy
Temporal Key Integrity Protocol (TKIP): A Wi-Fi encryption protocol supported on Versa appliances as an alternative to CCMP for securing wireless networks. See: Use the Configure Dashboard
Tenant: An organizational unit, also called an organization, representing a customer or enterprise in Versa's multitenant architecture; gateways, licenses, users, policies, and reports are scoped by tenant, and tenants can have subtenants. See: Flow Logs , Manage Custom Reports
Tenant Organization: A customer organization configured beneath a provider organization in Versa's multitenant model; tenant users are scoped to the devices, policies, and resources of their own organization. See: Monitor Provider and Tenant Organizations , Integrate Versa Director with Azure SSO
Terminal Server Agent (TSA): An agent installed on a Windows terminal server that distinguishes users sharing one IP address by allocating each a unique source port range and reporting the mapping to a VOS device or gateway, enabling user- and group-based policy enforcement. See: Install and Use a Terminal Server Agent , Configure a Terminal Server Agent
Terraform: An open-source infrastructure-as-code tool from HashiCorp that provisions infrastructure across cloud providers using a declarative configuration language; Versa supplies Terraform templates and a provider plugin to automate deployment of headend, branch, and orchestration resources. See: Terraform Integration , Install on Azure
Threat Feed: A data source of malicious indicators — IP addresses and ports, IP ranges, FQDNs, or URL patterns — ingested by the VMS threat intelligence service and referenced by address groups, URL categories, or DNS filtering profiles in policy rules. See: Configure Threat Intelligence from VMS , Use the VSync Tool (NGFW)
Threat Intelligence: Data about known-malicious indicators, such as IP addresses, ports, and URLs, maintained in databases and distributed to VOS devices so security policies can be enforced against it; delivered by VMS as a service, replacing the earlier VSync tool. See: Configure Threat Intelligence from VMS , Enable and Configure VMS Services
Time to Live (TTL): A packet header field decremented at each routing hop; when it reaches zero the packet is discarded. Also the lifetime of cached records such as DNS responses, configurable in VOS routing and DNS features. See: Troubleshoot the SASE Client , Configure SD-WAN Policy
Time-Based One-Time Password (TOTP): A one-time password derived from a shared secret and the current time, generated by an authenticator app typically after scanning a QR code, and valid for a short window; used as a second factor for Versa SASE client registration. See: Configure the Versa Secure Access Service (Secure SD-WAN) , Versa SASE Client Quick Start
Titan Mobile: The Android and iOS companion application to Versa Titan Portal, used to activate appliances via Versable, Wi-Fi, or GZTP and to configure and monitor site, device, and security status from a phone. See: Titan Portal 9.1.0 , Titan Mobile 8.0.0
Titan Portal: The cloud-based web dashboard of Versa Titan used to deploy, configure, activate, and monitor Secure SD-WAN branch devices and sites, and to manage organizations, templates, users, licenses, and tenants. See: Add and Manage New Customers on the Titan Portal Dashboard , Titan Portal 8.1.0
Titan Shop: Versa's legacy order-management portal for managed service providers, used to create customers and manage hardware, licenses, and private gateways; deprecated as of Titan Release 9.3.1, with its functionality folded into the Titan Portal dashboard. See: Versa Titan Release Notes for Releases 9.3.0 and 9.3.1
TLS Decryption: The interception and decryption of TLS/SSL-encrypted traffic, using an intermediate CA certificate, so that security services such as IPS, anti-malware, CASB, and DLP can inspect the payload; also called SSL inspection, with Do-Not-Decrypt rules excluding chosen destinations. See: Best Practices for CASB Security , Configure SD-WAN TLS Decryption
TLS Decryption Profile: A Versa Concerto object that defines certificate setup, inspection options such as OCSP validation, and decryption options — supported TLS versions, key exchange algorithms, and cipher suites — applied by a TLS decryption rule. See: Configure SASE TLS Decryption
Top-of-Rack Switch (ToR): A switch deployed at the top of a server rack to connect servers to the network; the CSX8300 appliance can be deployed in this role with 25-Gigabit Ethernet server ports. See: At a Glance Cloud Services Switch 8000 Series
Traffic Detection Function (TDF): A VOS service, enabled globally and within a service node group, that identifies and classifies application traffic to support features such as flow mirroring and historical Application Performance Monitoring. See: Configure Application Performance Monitoring , Configure Flow Mirroring
Traffic Engineering: The practice of selecting the paths that traffic transits through a network to achieve fine-grained control over traffic flow and optimal use of all available WAN transport paths. See: SD-WAN Traffic Engineering: Configuration and Verifications
Traffic Mirroring (SPAN): A capability, also known as switched port analyzer (SPAN), that copies network traffic from an interface and sends it to another interface for out-of-band security monitoring, content inspection, or troubleshooting. See: Configure NPU Traffic Mirroring
Traffic Monitoring Policy: A policy that uses Layer 3 through Layer 7 match criteria, such as applications, addresses, and services, to associate traffic with flow-data (NetFlow), web, DNS, and performance monitoring actions exported through a logging profile. See: Configure SD-WAN Traffic Monitoring , Configure Log Export Functionality
Traffic Steering: The SD-WAN capability of directing application traffic across available WAN paths, gateways, or local breakout based on match criteria, path priority, and SLA compliance, implemented through forwarding profiles associated with traffic-steering policies. See: Consolidated SD-WAN Design Guide , SD-WAN Traffic Optimization
Traffic-Steering Policy: A policy that classifies incoming traffic using match criteria such as application, source and destination address, zone, and user, then applies an action such as allow, deny, or a specific forwarding and TCP optimization treatment. See: Configure Traffic-Steering Policies and Rules
Transit Gateway (TGW): An AWS managed service that acts as a central hub connecting multiple VPCs and on-premises networks within and between AWS regions, used to attach a VPC and an IPsec VPN connection to a Versa SASE gateway with centralized routing. See: Versa Networks SASE Gateway Integration with AWS Cloud
Transparent Proxy: A proxy mode that intercepts SSL/TLS traffic destined for any IP address on a specific port without requiring explicit proxy configuration on the client browser. See: Configure Kerberos Authentication , Configure Kerberos Authentication (NGFW)
Transport Domain: A named, numerically identified construct that groups WAN networks sharing the same underlay reachability, such as internet or MPLS, controlling which WAN interfaces, sites, and Controller nodes can establish SD-WAN connectivity with each other. See: Configure Transport Domains and WAN Networks , Configure a WAN Transport Network to a Deployed Controller
Transport Layer Security (TLS): An industry-standard cryptographic protocol that secures client-server communications using a handshake protocol for authentication and key negotiation and a record protocol for protecting data; used for HTTPS and as a Versa SASE client tunnel transport. See: Versa SASE Portal Overview , Upload Custom CA Certificate, Key File, and CA Chain
Transport Virtual Router: A virtual router on a VOS device responsible for one or more WAN transport links; it maintains its own forwarding table, forms part of the underlay network, and can run a routing protocol for split-tunnel gateways or direct internet access. See: Understand SD-WAN Interface Numbering , Secure Control and Data Overlay Tunnel Solution
Trivial File Transfer Protocol (TFTP): A minimal file-transfer protocol used mainly for bootstrapping and staging device images and configuration files. See: Titan Portal 9.1.1 , Titan Portal 9.1.0
Trunk Port: A Layer 2 interface mode used for ports linking to other switches, in which the interface carries traffic for multiple VLANs over a single link and accepts only tagged packets matching its configured VLAN IDs and ranges. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure Access and Trunk Interfaces in Concerto
Trusted Network Detection (TND): A Versa SASE client capability that detects when a device is inside a trusted corporate network, via a reachable trusted host, and bypasses tunnel creation to the SASE gateway, routing traffic through on-premises security while maintaining a control channel for posture evaluation. See: Configure Detection of Trusted Networks for SASE Gateways , Step-By-Step Configuration:
Trusted Network Hostname (TNH): A hostname or IP address reachable only from within the enterprise network that the Versa SASE client tests to determine whether it is on a trusted network, bypassing tunnel establishment to the gateway when the host is reachable. See: Configure Detection of Trusted Networks for SASE Gateways , Step-By-Step Configuration Guide for Versa Secure Private Access (VSPA)
Trusted Platform Module (TPM): A dedicated hardware security chip that securely stores cryptographic keys and supports secure boot; integrated into CSG and CSX appliances, it holds the private key for each VOS device's Versa-signed certificate installed during zero-touch provisioning. See: At a Glance , At a Glance Cloud Services Switch 4000 Series
Tunnel Monitoring: A SASE client feature that monitors tunnel health by periodically checking the reachability of configured hosts through the established VPN tunnel. See: Use the Versa SASE Client Application , Use the Versa SASE Client with Concerto
Tunnel Virtual Interface (TVI): A logical VOS interface, named with the tvi prefix, used to terminate IPsec, GRE, VXLAN, and SD-WAN tunnels — including static control-plane tunnels toward Controller nodes and dynamic data-plane tunnels toward other SD-WAN devices, numbered per tenant. See: HA-Based VMS Deployment in Headend Environment , Enable and Configure VMS Services
TWAMP Control: The full TWAMP mode in which a control client and control server negotiate SLA test parameters over a TCP connection before measurement begins, spawning TWAMP Light child sessions to perform the probe-based measurements. See: Configure TWAMP Control Client and Server Sessions , Configure TWAMP Light Test Sessions
TWAMP Light: A lightweight TWAMP mode that skips control-session negotiation and directly exchanges probe packets between a session sender and session reflector to measure network performance, used when full TWAMP control is unsupported or unneeded. See: Configure TWAMP Light Test Sessions , Configure TWAMP Control Client and Server Sessions
Twice NAT: A network address translation technique that translates both the source and destination IP addresses of a packet as it transits a router, commonly used to interconnect networks with overlapping or private address space. See: Twice NAT – Scenarios, Implementation and Verification , VOS High Availability in AWS Using Gateway Load Balancer
Two-Factor Authentication (2FA): An authentication method requiring a second verification factor, such as a one-time password delivered by SMS or email, in addition to primary credentials; Versa secure access portals and client profiles can enable it per user, group, region, or device. See: Configure AAA , Configure the Versa Secure Access Service (Secure SD-WAN)
Two-Way Active Measurement Protocol (TWAMP): A protocol, defined in RFC 5357, for measuring network performance metrics such as delay, jitter, and packet loss between two endpoints; VOS devices and the SASE client use it for SLA compliance checks and path-quality measurement. See: Analytics Log Collector Log Types Overview , TWAMP Logs

U

UEFI Secure Boot: A firmware security mechanism that ensures a device boots only trusted software by verifying the signature of each boot component in a chain of trust, from the boot loader through the kernel and kernel modules. See: Verify Support for UEFI Secure Boot
Underlay Network: The physical or provider transport network, such as MPLS or the internet, over which encrypted SD-WAN overlay tunnels are built; underlay connections can be shared or kept disjoint per tenant for control-plane segmentation. See: Configuring Disjoint Underlay MPLS Connections on Controller for Different Tenants
Unified Endpoint Management (UEM): A category of software, such as Microsoft Intune or Ivanti Neurons, that provisions, secures, and monitors desktop and mobile devices from a single console; formerly called SASE Mobile Device Manager (MDM) in Versa documentation, it supplies device compliance data for SASE client verification and risk scoring. See: Security , Configure VMS to Integrate EDR Platforms
Unified Entity Risk Profile: A Concerto configuration object that assigns weighted percentages to risk-score inputs — EDR, Vulnerability Threat Manager, and UEM categories and their vendor products — so a composite per-entity risk score can be computed and enforced through policy. See: Configure VMS to Integrate EDR Platforms , Configure Unified Risk Scores
Unified Threat Management (UTM): A consolidated security approach combining multiple protection functions, such as firewall, antivirus, content filtering, and intrusion prevention, in a single appliance; provided by VOS on CSG and CSX appliances alongside SD-WAN and routing. See: Configure a Secure SD-WAN Tenant , Configure Main Templates
Uninterruptible Power System (UPS): A device that protects an appliance's power supply from outages, brownouts, and voltage surges or spikes; deployed as standby, line-interactive, or online types, with online systems providing zero transfer time during a power event. See: Surge Protection for WAN Lines
Universal CPE (uCPE): Customer premises equipment with built-in compute capacity that hosts third-party virtual network functions alongside native VOS services, consolidating branch networking functions on one certified white-box or x86 platform instead of separate standalone appliances. See: Infrastructure , Networking
URL Category: A predefined or custom classification, such as Gambling or Social Network, assigned to a URL from a locally cached and cloud-based database and used as match criteria in URL-filtering, traffic-steering, and security policies. See: Configure Reusable Objects , Configure SD-WAN Access Control Policies
URL Filtering (URLF): A security control that enforces allow, block, captive-portal, or other actions on HTTP/HTTPS traffic based on URL category, URL reputation, and administrator-defined allow and deny lists. See: Configure Profile Elements , Configure SD-WAN Security Access Control Policies and Rules
URL Filtering Profile: A profile that enforces actions on HTTP/HTTPS flows based on URL category, URL reputation, and allow/deny lists; applied to a security policy rule to determine whether traffic is alerted, allowed, blocked, or redirected to a captive portal. See: Configure URL Filtering (NGFW)
URL Reputation: A risk classification — Trustworthy, Low Risk, Moderate Risk, Suspicious, or High Risk — assigned to a URL or IP address and used, alongside URL category, to determine security policy enforcement actions. See: Configure SD-WAN URL-Filtering Policies , Configure SD-WAN URL-Filtering Profiles
URL-Based ZTP: A zero-touch provisioning method in which an onsite administrator connects a laptop or phone to a VOS device and clicks an emailed link pointing to a staging Controller node, which completes device activation; it decouples a specific hardware chassis from a branch location. See: Activate VOS Devices
User and Entity Behavior Analytics (UEBA): A security discipline that uses machine learning to baseline user, device, and entity behavior and detect anomalous activity indicating insider threats, compromised accounts, or advanced persistent threats, rather than relying solely on known attack signatures. See: Security , Networking
User Certificate Authentication: An authentication method that validates an individual user's identity with a digital certificate bound to their personal profile, matching the certificate's Common Name against the authenticated username from SSO or LDAP to prevent spoofing on shared devices. See: Step-By-Step Configuration: , Step-By-Step Configuration: Versa Secure Private Access (VSPA)
User Datagram Protocol (UDP): A connectionless transport protocol used for low-overhead traffic such as DNS and VoIP; Versa SD-WAN data-plane tunnels and SLA probes commonly run over UDP. See: Firewall Requirements , Configure VOS Device Alarms
User Principal Name (UPN): The fully qualified username for a domain account, in the form user@domain; the WMI agent can send a user's UPN to the VMS server so it is associated with the user's IP address record. See: Install and Configure the WMI Agent
User-Based Security Model (USM): The SNMPv3 security framework that secures SNMP messages through per-user configuration of security level, authentication protocol, privacy protocol, and keys on both the SNMP agent and manager. See: Configure SNMP , Manage Organization Settings
User-Defined Action: A reusable object that specifies the response — such as allow, block, ask, justify, override, redirect, or sinkhole — taken when traffic matches a URL filtering, DNS, IPS, IP reputation, or CASB profile rule. See: Configure User-Defined Actions , Configure User-Defined Actions (NGFW)
User-Defined Application: A custom application object, or a modified copy of a predefined application, that can be assigned risk and productivity levels, tags, and family and subfamily classifications for use in SD-WAN policies and subprofiles. See: Configure Reusable Objects

V

VDSL2: A very-high-speed DSL standard supporting data rates over 200 Mbps and triple-play voice, video, and data services, supported on CSG NIC modules. See: Network Interface Cards , Network Interface Cards
Verbo: An intelligent, context-sensitive chatbot assistant embedded in the Versa Director, Analytics, and Concerto GUIs that uses natural language processing, AI, and machine learning to answer questions, assist with configuration, and guide troubleshooting. See: Use Verbo Chatbot , Director GUI Overview
Versa Advanced Logging Service (ALS): A Versa-managed, cloud-hosted logging service that offloads high-volume logs, such as flow and web-monitoring logs, from on-premises Analytics clusters, providing on-demand scaling, secure transport, and additional retention; subscribed in multiples of 1 TB per region. See: Configure the Versa Advanced Logging Service , Analytics Log Screens by Title
Versa Advanced Networking Insights: A SaaS offering that applies AI to Versa Analytics telemetry to provide network signal prediction, anomaly detection, user and entity behavior analytics, and alarm suppression, compression, and prioritization for proactive monitoring and capacity planning. See: Versa Advanced Networking Insights Overview
Versa Advanced Security Cloud (ASC): A licensed cloud security framework that provides microservices such as ATP/DLP sandboxing, clientless access, remote browser isolation, and device risk scoring to Versa Cloud Gateways; deployable on-premises on Kubernetes as Versa Secure Lens. See: Configure SASE Tenants , Deploy an SSE Gateway and Onboard Tenants Using Concerto
Versa Analytics: The Versa headend component that collects and analyzes logs and telemetry from VOS devices, providing device, network, and security dashboards and reports, traffic-volume estimation, and log streaming to third-party SIEM platforms. See: Core Platforms , Infrastructure
Versa Analytics Driver: The program on each Analytics log collector node that performs extract, transform, and load operations on stored raw logs, inserting the processed data into the node's analytics and search datastores and moving each log to a backup subdirectory. See: Configure Log Collectors and Log Exporter Rules , Overview of Analytics Troubleshooting
Versa CLI: The text-based command-line interface used to view, configure, and manage settings on Versa Director, Versa Analytics nodes, and VOS devices, accessed from a shell account by issuing the cli command. See: Access the Versa CLI
Versa Cloud Gateway (VCG): A Versa-hosted SASE gateway that terminates SASE client and branch connections, providing authentication, ZTNA-based application access, secure internet access, and SD-WAN overlay connectivity; a tenant can be assigned multiple logically isolated VCGs. See: Configure SASE Tenants , Deploy an SSE Gateway and Onboard Tenants Using Concerto
Versa Cloud NGFW: A subscription-based next-generation firewall delivered as a SaaS offering through cloud marketplaces such as AWS Marketplace, licensed per account and region with configurable core counts and optional remote access VPN. See: Subscribe to Versa Cloud NGFW (SaaS) Service Using AWS Marketplace , Onboard Versa Cloud NGFW (SaaS) Service License on AWS
Versa Concerto: Versa's cloud-based orchestration and lifecycle management platform used to configure, deploy, and monitor SD-WAN, SSE, and SASE services, policies, and profiles across tenants and gateways. See: Best Practices for CASB Security , Core Platforms
Versa Director: The centralized management and orchestration console used to configure, monitor, and administer VOS devices, templates, and organizations across a Versa deployment, and to access Analytics dashboards and reports. See: Core Platforms , Infrastructure
Versa Directory: A Versa-hosted identity provider service, based on LDAP, that lets administrators create and authenticate users and groups for SASE client authentication without requiring a customer-managed directory; available for Versa-hosted SSE services. See: Configure SD-WAN User and Device Authentication , Configure SD-WAN User and Device Authentication
Versa Headend: The set of management, analytics, orchestration, monitoring, and controller components — Versa Concerto, Director, Analytics, Controller, and Messaging Server — that together manage Versa Secure SD-WAN deployments, deployable on-premises or as a SaaS instance. See: Versa Secure SD-WAN Licensing Overview (2019 to 2024)
Versa Hosted Management (VHM): Versa's cloud-based, SaaS-delivered headend and orchestration service, offered as a shared multitenant or dedicated instance, that eliminates the need for customers to deploy Director, Concerto, Analytics, Controller, and Messaging Service on-premises. See: Versa Secure SD-WAN Licensing Overview (2019 to 2024)
Versa IdP: Versa Networks' centralized identity provider system used to authenticate Titan Portal and SASE gateway users, replacing per-device local authentication. See: Versa Titan Release Notes for Release 10.0, 10.1.2, and 10.2.2
Versa Link Rank (VLR): A consolidated score from 0 (best) to 100 (worst) representing an application's path performance for a session, derived from TCP retransmissions, network delay, and active and passive monitoring metrics, and used to select the best-performing SD-WAN path. See: Flow Logs , Passive Application Performance Monitoring Logs
Versa Messaging Service (VMS): A scalable, Kubernetes-based message-streaming headend component that distributes real-time data — such as user identity events, threat feeds, device risk scores, and endpoint information — between Versa headend components, VOS devices, and SASE gateways. See: Core Platforms , User and Entity Behavior Logs
Versa Operating System (VOS): The operating system that runs on Versa's physical and virtual appliances, integrating SD-WAN, routing, next-generation firewall security, QoS, multitenancy, and analytics functions in a single software stack. See: Infrastructure , Core Platforms
Versa Portal: The web-based management dashboard used to onboard, configure, monitor, and license Versa devices and organizations, including inventory, user management, and network and security settings. See: Manage Device Inventory , Manage Organization Settings
Versa SASE Portal: A cloud-based management interface for configuring client-to-cloud connectivity through Versa Secure Access and Secure Web Gateway services, covering real-time protection rules, secure client access, TLS decryption, and bandwidth limits. See: Versa SASE Portal Overview , Secure Communication for SD-WAN Devices and SASE Clients
Versa Secure Access (VSA): Versa's client-based secure remote access service — comprising a portal, gateway, and client — that provides SD-WAN or secure VPN tunnel connectivity to enterprise networks and secure web gateway internet access; the earlier product name for the Versa SASE client. See: Secure Access Dashboards , Secure Access Logs
Versa Secure Access Fabric (VSAF): A tenant product offering that combines Versa Secure Internet Access, Versa Secure Private Access, and Premier Secure SD-WAN into Essential, Essential Plus, Professional, and Elite bundles, each unlocking a different set of optional security add-ons. See: Configure SASE Tenants , Configure Unified Risk Scores
Versa Secure Cloud IP Platform: A cloud-native, multitenant software platform that delivers software-defined Layer 3 through Layer 7 services with full programmability and automation, addressing SD-WAN, SD-Security, and SD-Branch use cases for the WAN edge in a single unified platform. See: Solution Overview , Solution Components
Versa Secure Internet Access (VSIA): The Versa SSE service that securely connects users to the internet, public clouds, and SaaS applications through Versa's fabric of secure web gateways, consolidating SWG, NGFW-as-a-service, CASB, and DLP capabilities. See: Configure SASE Tenants , SD-WAN–SSE Hub Integration
Versa Secure Lens: A streamlined on-premises deployment of Versa Advanced Security Cloud functionality, run on a Kubernetes cluster of control-plane and worker nodes, that supports EDR platform integration and the device risk score service for organizations with data-residency requirements. See: Configure ASC Worker Nodes and Deploy Versa Secure Lens , Enable and Configure VMS Services
Versa Secure Private Access (VSPA): A Zero Trust Network Access solution that brokers identity- and policy-based least-privilege access from remote or branch endpoints to private applications hosted on-premises or in the cloud, via an SSE gateway. See: Configure SASE Tenants , ZT-LAN Features and Capabilities
Versa Secure Private and Internet Access (VSPIA): A Versa endpoint-client service option that combines VSIA and VSPA, providing both split-tunnel and full-tunnel connectivity for private application and internet traffic. See: Configure Unified Risk Scores , VSIA, VSPA, and VSPIA Behavior Changes Between Titan Releases 11.0 and 11.2
Versa Service Header (VSH): A proprietary UDP-based encapsulation header that a standby VOS device adds to packets it forwards to the active device during data punting in an interchassis high-availability deployment. See: Configure Stateful Interchassis HA
Versa Services Management (VSM): A CLI diagnostics interface used to inspect NPU packet trace data, either hex data or a saved trace file, with output shown directly in the VSM diagnostics CLI rather than written to a log file. See: Troubleshoot NPU Packet Trace
Versa Session Management Daemon (VSMD): The VOS process that tracks secure-access session history, IPsec tunnel configuration and certificate status, and SD-WAN site and domain information; accessed through its VTY shell to verify SASE gateway and client connectivity. See: Troubleshoot the SASE Gateway
Versa Smart Aggregator: A component placed between agentless devices and Versa SASE gateways that provides port aggregation and tenant-aware load balancing of traffic, forming part of a SASE gateway POP. See: SASE on SIM Solution Overview
Versa Staging Server: A cloud-hosted node responsible for the initial bootstrapping and authentication of new branch devices during zero-touch provisioning; it verifies a device's Versa-signed certificate, sends a staging configuration, and redirects the device to the Versa Controller. See: Solution Architecture , SD-WAN Solution Architecture
Versa Titan: Versa's cloud-managed SD-WAN offering for small and midsize branches, comprising the Titan Portal web dashboard and the Titan Mobile application, used to activate, configure, secure, and monitor CSG and vCSG appliances running VOS. See: Core Platforms , Versa Networks Software Release Lifecycle and End-of-Life Policy
Versa URM: Versa Networks' in-house cloud lookup platform that consolidates URL category and reputation data from multiple sources, serving cloud URL lookup requests for VOS releases 22.1.3 and later with SPack 2177 or later. See: Configure Cloud URL Lookup
Versa Zero Trust – Premises: The Zero Trust Network Access component of Versa Zero Trust Everywhere that applies granular, least-privilege access policies to campus and branch users at the point of connection. See: Security
VersaAI: The adaptive intelligence layer of the VersaONE platform, combining machine learning, predictive analytics, natural language processing, and LLM-assisted workflows, including the Verbo chatbot and MCP-based natural-language operations against Versa Director and Concerto. See: Core Platforms
Versable: A Versa Titan appliance-activation method in which a mobile phone running Titan Mobile uses short-range wireless discovery to pair with a nearby powered-on appliance and automatically register, configure, and reboot it, without requiring Wi-Fi SSID or serial-number entry. See: Titan Mobile 10.0 , Getting Started with Titan Portal
VersaGPT: A generative-AI tool, embedded in Verbo and in the Versa Networks website search, that answers configuration questions with guided how-to steps, recommendations, and links to relevant Versa Director or Concerto documentation and screens. See: Use Versa Chatbot
VersaONE: Versa Networks' Universal SASE platform that converges networking and security — Secure SD-WAN, Secure SD-LAN, SSE, and next-generation firewall — into a single software stack running on VOS, managed through Versa Director, Concerto, and Analytics. See: Core Platforms , Introduction
Virtual Appliance: A VOS deployment that runs on hypervisors, public clouds, or containers instead of dedicated hardware, providing the same networking, security, and analytics capabilities as a hardware appliance. See: Infrastructure , Versa Director REST API Overview
Virtual CSG (vCSG): The virtual form factor of the Cloud Services Gateway appliance, deployable on a hypervisor or in a public cloud VPC and offered in sizes such as Medium, Large, XL, and 2XL for SD-WAN branch or SASE gateway roles. See: Titan Portal 9.1.1 , Portal for Titan Order Management for MSPs
Virtual Customer Premises Equipment (vCPE): A standalone device, physical or virtual, deployed at a customer site to perform Layer 3 through Layer 7 network functions such as routing, firewall, and security services. See: Install on Google Cloud Platform , Install on Google Cloud Platform
Virtual Extensible LAN (VXLAN): An encapsulation protocol that carries Layer 2 Ethernet frames over a Layer 3 IP network using UDP with a 24-bit network identifier; Versa SD-WAN uses VXLAN with EVPN and IPsec to build overlay tunnels between sites. See: Networking , Configure EVPN VXLAN for ZT-LAN
Virtual IP Address (VIP): An IP address not bound to a single physical interface, used for high availability and load balancing — for example the address VRRP advertises, or the front-end address of a load-balanced service. See: DLP Configuration Guide , Configure and Activate Multitenant Gateway Devices
Virtual Local Area Network (VLAN): A logical network segmentation technology that groups devices without physically relocating them and reduces unnecessary broadcast and multicast traffic; Titan devices support VLAN tagging on Ethernet ports. See: Titan Portal 9.1.1 , Titan Portal 8.1.0
Virtual Network (VNet): An Azure networking construct that provides logical isolation of cloud resources, similar to an on-premises network, enabling secure communication between Azure resources, on-premises environments, and the internet. See: Versa SASE Gateways Integration with Azure Cloud
Virtual Network Computing (VNC): A cross-platform client/server screen-sharing protocol in which a server component on the remote computer transmits its screen to a viewer and relays keyboard and mouse input back, giving the connected user remote control. See: Configure Clientless Applications in Concerto
Virtual Network Function (VNF): A network function, such as a firewall, router, or WAN optimizer, implemented as software running on a virtual machine instead of dedicated hardware; VNFs are selected from a vendor catalog and onboarded onto uCPE-capable devices. See: Versa Director REST API Overview , SD-WAN Headend Design Guidelines
Virtual Network Interface (VNI): The Versa interface naming scheme (for example, vni-0/0) that maps a VOS appliance's physical Ethernet, SFP, and QSFP ports to logical interfaces referenced in Director, Concerto, and CLI configuration. In VXLAN contexts, VNI instead expands to VXLAN Network Identifier – the 24-bit segment ID carried in the VXLAN header; see VXLAN. See: VXLAN , Interface Numbering
Virtual Private Cloud (VPC): A logically isolated virtual network within a public cloud provider such as AWS, in which a customer launches resources while controlling its own IP address ranges, subnets, and routing configuration. See: Deploy a VOS Branch in AWS Using Transit Gateway , Versa Networks SASE Gateway Integration with AWS Cloud
Virtual Private Gateway (VGW): The AWS-side endpoint for a site-to-site VPN connection, acting as a VPN concentrator that terminates IPsec tunnels between a VPC and an external network such as a Versa SASE gateway. See: Versa Networks SASE Gateway Integration with AWS Cloud
Virtual Router (VR): A routing instance on a VOS device, such as a LAN, transport, or management VR, that maintains its own routing table and interface assignments to isolate tenant traffic and segment routing between interfaces and organizations. See: Workflow-Based Split Tunnel Options Explained , Install and Configure VMS
Virtual Router Redundancy Protocol (VRRP): A protocol that provides gateway redundancy on a LAN by sharing a virtual IP address among two or more routers; the master forwards traffic and a backup with the next-highest priority takes over if the master fails. See: Networking , Monitor VOS Device Networking Services
Virtual Routing and Forwarding (VRF): A technology that lets multiple independent routing and forwarding table instances coexist on a single device, so overlapping IP address spaces and per-tenant or per-transport routes remain isolated. See: Networking , Deploy an SSE Gateway and Onboard Tenants Using Concerto
Virtual Service Node (VSN): A virtual machine instance on a VOS device, identified by a VSN ID in Analytics log records; elasticity profiles can spawn additional VSNs to scale processing capacity automatically based on demand. See: Alarm Logs , Active Application Performance Monitoring Logs
Virtual Wire: A VOS deployment mode, also called bump in the wire, in which two Ethernet interfaces with no IP addresses form an inline pair that passes traffic transparently while stateful firewall services are applied, requiring no changes to neighboring devices. See: Configure Virtual Wires , Configure Firewalls
VNF Manager: The Versa component used to manage and monitor virtual network functions within a Versa SD-WAN environment, referenced by its own IP address in site and organization configuration. See: Configure SD-WAN Sites , Configure Miscellaneous Parameters
VOS Branch: Any Versa customer premises equipment, physical or virtual, hosted and managed by a service provider on behalf of an enterprise or by the enterprise itself, on a headend separate from the Versa Cloud Gateway. See: Versa Secure SD-WAN Integration with Versa SSE
VOS Lite: A resource-optimized VOS software image for small form-factor devices, such as ARM-based wireless access points and the CSG350 and CSG730 appliances, that deactivates advanced features including ADC, DLP, kernel crash dump, and Universal CPE. See: Versa Software Types , Deploy the VOS Lite Software
VPN Instance: A Concerto configuration object that defines a tenant VPN's topology, routing redistribution, and split-tunnel and Direct Internet Access settings, referenced by a device's master profile to determine how it connects into the SD-WAN fabric. See: Configure Profiles , Versa Networks SASE Gateway Integration with AWS Cloud
VPN Profile: A reusable VOS object that defines the tunnel protocol, IKE version, transform algorithms, peer authentication keys, and number of tunnels used to establish a site-to-site or branch-to-branch VPN connection. See: Configure Basic Features , Configure Site-to-Site Tunnels
VSync: A Versa tool that downloads threat intelligence data — IP addresses, ports, and URLs — from web or REST servers, converts it to a Versa-specific format, and distributes full or incremental updates to VOS SD-Security devices, with high-availability dual-node support. See: Use the VSync Tool with VOS Devices
Vulnerability Profile: A profile that defines which IPS signature-based and anomaly-based rules apply to traffic and the enforcement action taken on a match; predefined profiles can be used or overridden, and custom profiles built from CVE, confidence, and severity criteria. See: Configure Intrusion Detection and Prevention , Configure Intrusion Detection and Prevention (NGFW)
Vulnerability Rules: Custom rule definitions uploaded to Versa Director or VOS devices that determine the level of protection against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities. See: Configure Vulnerability Rules
Vulnerability Threat Manager (VTM): A category of third-party security products, such as Qualys, Tenable, and Microsoft Defender, that identify, assess, and prioritize vulnerabilities; VTM findings contribute CVE and compliance data weighted alongside EDR scores in Versa unified entity risk profiles. See: Configure Vulnerability Threat Management in Concerto , Configure Unified Entity Risk Profiles in Concerto
VXLAN Tunnel Endpoint (VTEP): The physical or virtual device or interface at either end of a VXLAN tunnel that encapsulates and decapsulates Layer 2 frames, mapping VLANs to VXLAN Network Identifiers. See: Configure EVPN VXLAN for ZT-LAN , Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later)

W

WAN Edge: The network-connectivity half of a SASE architecture, providing connectivity between users and applications through capabilities such as SD-WAN, quality of service, DHCP, and routing; typically delivered by a VOS-enabled appliance or device. See: Versa Secure SD-WAN Integration with Versa SSE
WAN Network: A Versa Director object, associated with a transport domain, that represents a distinct WAN underlay connection type used when configuring SD-WAN site and interface connectivity; WAN networks configured on a parent organization can be automatically propagated to its suborganizations. See: Configure Transport Domains and WAN Networks , Configure a WAN Transport Network to a Deployed Controller
Web Application Firewall (WAF): A security capability that inspects HTTP/HTTPS traffic against rule sets such as the OWASP Core Rule Set to detect and block injection attacks, cross-site scripting, and other application-layer threats; Versa provides an integrated WAF running natively on CSG-series edge gateways. See: SD-WAN Solution Architecture , Versa Integrated Web Application Firewall
Web Proxy: An intermediary server that forwards a user's web requests to destination sites under its own IP address, keeping the user anonymous and enabling caching that speeds up browsing. See: Versa Titan Release Notes for Release 10.0, 10.1.2, and 10.2.2
Webhook: An automated HTTP callback that a SaaS application sends to notify a subscriber of an event as it occurs, used, for example, to drive event-based policy scanning in API-based data protection. See: Configure Cloud Applications to Use with API-Based Data Protection
Webhook Notification: A Versa Director alarm-notification mechanism that posts a JSON payload, built from a configurable body template, to an external HTTP or HTTPS endpoint or platform such as ServiceNow when a matching alarm condition occurs. See: Configure Webhook Notifications for Alarms , Configure Notifications for Alarms
Weighted Random Early Detection (WRED): A congestion-avoidance algorithm that tracks queue depth and randomly drops packets according to configured loss-priority thresholds before the queue fills completely, as an alternative to tail drop; used in VOS QoS scheduling. See: Consolidated SD-WAN Design Guide , Configure CoS
Weighted Round-Robin (WRR): A scheduling algorithm that services multiple queues or paths in proportion to assigned weights; in VOS it schedules the four queues within each traffic class and is the default connection-selection method for SD-WAN traffic steering. See: Configure Hierarchical Scheduling , Consolidated SD-WAN Design Guide
White-Box Appliance: A third-party, vendor-agnostic hardware platform certified by Versa to run VOS software as an alternative to Versa-branded appliances, available from vendors such as Advantech, Caswell, Dell, Lanner, and Silicom. See: Versa SD-WAN White-Box Appliances , Solution Components
Wi-Fi Access Point Module (AP): An optional factory-installed, dual-band (2.4 GHz and 5 GHz) 802.11 wireless access point embedded in CSG-series appliances that delivers WLAN connectivity to the branch and integrates with VOS features such as QoS and spectrum analysis. See: Embedded Wi-Fi Module , Embedded Wi-Fi Module
Wide Area Network (WAN): A network that connects devices across broad geographic distances; on a VOS device, WAN interfaces such as broadband, MPLS, or wireless are the external transport connections used to reach the internet or remote sites. See: Configure WAN Interfaces in Concerto
Windows Management Instrumentation Agent (WMI): Versa software installed on a Windows device in an Active Directory domain that monitors AD login and logoff events and forwards them to a VMS server over TLS, enabling passive user authentication on secure SD-WAN devices without a captive portal. See: Install and Configure the WMI Agent , Enable and Configure VMS Services
Wireless LAN (WLAN): A network of devices connected by radio transmissions rather than wired connections, in which member devices share a common Service Set Identifier (SSID). See: Configure LAN Interfaces in Concerto
Wireless Wide Area Network (WWAN): A WAN interface type that provides wireless connectivity over LTE, 4G, or 5G cellular service, used when a branch lacks a wired connection; supported on VOS devices through an internal modem or external dongle, and previously called LTE. See: Configure Interfaces , Configure WWAN
Worker Thread (WT): A data-plane processing thread on a VOS service node that synchronizes session, NAT binding, and ADC persistency state with its peer worker thread on the standby node as part of interchassis HA. See: Configure Stateful Interchassis HA
Workflow Template: A guided configuration wizard in Versa Director or Concerto that automates the creation of complex, multi-object configurations — such as device onboarding, HA branches, tunnels, or SD-LAN settings — without manual object-by-object setup. See: Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) , Configure Regional Hub-and-Controller Nodes for SHHS Topologies

X

X.509 Certificate: A standard digital certificate issued by a Certificate Authority that contains a subject, an issuer, and a validity period; supported in DER and PEM encodings and used to authenticate nodes and clients and establish encrypted connections. See: Create and Manage Certificates , Configure MTLS Certificate-Based Authentication
xDSL: A family of digital subscriber line technologies that provide WAN connectivity over copper lines; supported as a PPPoE interface type on DSL-enabled CSG300 and CSG1000 series appliances, with LLC or VC-MUX multiplexing profiles. See: Titan Mobile 9.3.0

Z

Zero Trust: A security model that eliminates implicit trust in users, devices, and network locations, requiring continuous verification of identity and device posture before granting least-privilege access to any resource. See: Best Practices for CASB Security , Security
Zero Trust Network Access (ZTNA): A security framework that grants access to individual applications based on continuous verification of user identity, device posture, and context rather than implicit trust derived from network location, replacing broad network-level VPN access. See: Security , Core Platforms
Zero-Day Threat: A previously unknown vulnerability, attack, or malware variant for which no signature or patch yet exists, requiring behavior-based detection methods such as sandboxing, AI/ML analysis, or anomaly detection rather than signature matching. See: Configure Advanced Threat Protection , Configure Custom IPS-Filtering Profiles
Zero-Touch Provisioning (ZTP): An automated onboarding process that activates and configures a network device without an on-site technician or manual configuration; Versa supports several methods, including global ZTP, URL-based ZTP, and CLI- or USB-based staging. See: Configure Appliances, Hubs, and Hub–Controllers , Deploy Lifecycle Overview
Zero-Trust LAN (ZT-LAN): Versa's on-premises LAN solution combining ZT Edge and Secure SD-LAN to deliver Zero Trust Network Access, microsegmentation, and software-defined campus and branch networking, running VOS on Ethernet switches, WLAN access points, and on-premises appliances. See: ZT-LAN Architecture , ZT-LAN Features and Capabilities
Zone: A Versa security construct representing a set of interfaces and networks, used as source or destination match criteria in SD-WAN, access-control, and TLS-decryption policy rules, and optionally associated with a zone protection profile. See: Configure SD-WAN Policy , Configure SD-WAN Security Access Control Policies and Rules
Zone Protection: A VOS stateful firewall feature that detects and mitigates flood, scan, and other network attacks targeting an appliance before a session is created, protecting network performance and resource consumption. See: Zone Protection Profile
Zone Protection Profile: A Versa configuration object that defines flood protection, scan protection, and traffic-anomaly protection thresholds and actions, applied to the first packet of new flows entering a security zone to block malicious or reconnaissance traffic. See: Service Alarms , Configure Zones and Zone Protection Profiles (NGFW)

ON THIS PAGE

Number
A
B
C
D
E
F
G
H
I
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Z