The SASE Client – the Versa SASE Client – is Versa’s native VPN application – available for Android, Chromebook, iOS, Linux, macOS, and Windows – that connects remote users to Versa Secure Access gateways over IPsec, TLS, or DTLS tunnels, enforcing Zero Trust policy through multifactor authentication, device posture checks, and continuous best-gateway and best-path selection.
Key takeaways
- A native VPN app for Android, Chromebook, iOS, Linux, macOS, and Windows.
- Formerly named the Versa Secure Access (VSA) client application.
- Registers with a portal, then tunnels to a secure access gateway.
- Managed from Versa Director’s Secure Access Service or from Concerto.
- Enforces MFA, device posture, split tunneling, and best-gateway selection.
On this page: Why it mattersHow it worksSASE Client deployment modelsSASE Client & VersaFAQ
Why is a SASE Client important?
Zero Trust access depends on a consistent enforcement point on the endpoint itself, not just at the network edge. The SASE Client is that enforcement point: the same application, across every major desktop and mobile OS, that authenticates the user, checks device posture, and carries every rule an administrator writes – split tunneling, trusted-network detection, data-loss-prevention controls – onto the device the user is working from. Without it, remote access falls back to a plain VPN tunnel with no continuous verification once the connection is up.
It is also what makes Zero Trust practical rather than theoretical for end users. The client re-evaluates context on an ongoing basis – switching to a healthier gateway or path when performance degrades, bypassing the tunnel only when trusted-network conditions are provably met, and reporting device and connection telemetry back to the platform – so access decisions stay current instead of being made once at login and never revisited.
What is a SASE Client?
The SASE Client is a native VPN client, historically named the Versa Secure Access (VSA) client application before the software was rebranded across releases. It establishes remote-access VPN connectivity over IPsec (IKEv2), TLS, or DTLS tunnels, per the gateway’s configured tunnel order, with enterprise-grade authentication, including EAP-MSCHAPv2, two-factor authentication, SMS or email one-time passwords, TOTP, SAML, and certificate-based device authentication. The same application ships for every major desktop and mobile platform, so the connection experience and the policies applied to it stay consistent regardless of which device a user happens to be on.
Connecting has two stages. The client first registers with a secure access portal, which authenticates the user (locally or via LDAP), pushes configuration, policy, and routes, and issues the one-time secret used to establish the tunnel. It then connects to a secure access gateway for the VPN session itself, with behavior – which policy applies, which gateway to prefer, whether traffic is split-tunneled – controlled by user, group, region, or device.
SASE Client deployment models
The same client app is managed from one of two backends. In the Director-managed model, an administrator configures the Versa Secure Access Service directly on VOS devices in Director – Services > Secure Access > Portal and Gateway, with secure access profiles, routes, and DNS resolvers defined per template, and the portal and gateway roles can live on the same device or on two separate ones. In the Concerto-managed model, the client is governed instead by secure client-based access rules configured through Concerto’s SASE workflows, connecting users to Versa Cloud Gateways rather than to a VOS-hosted portal and gateway pair. Which model applies depends on whether the tenant’s SASE services are administered from Director or from Concerto; the client binary, its supported platforms, and most of its feature set are otherwise the same.
SASE Client & Versa
The SASE Client is the user-facing edge of Versa’s Secure Access Service: it registers against a portal, tunnels to a gateway, and from there rides the same security stack – NGFW, IPS, and policy enforcement – that protects VOS branch traffic. Features such as digital experience monitoring and periodic metric reporting feed client and connection telemetry back to Versa Analytics, while endpoint information profiles let administrators classify and act on device posture before granting access, re-checked on a configurable interval (typically every 10 minutes); Force Tunnel and Split Tunnel settings decide which traffic the client steers into the tunnel. Enterprise controls like custom branding, tamperproof protection, and FIPS-compliant ciphers round out its fit for regulated deployments. See Use the Versa SASE Client Application and Use the Versa SASE Client with Concerto for the client feature set, and Configure the Versa Secure Access Service for the Director-side setup.
Frequently asked questions
What operating systems does the SASE Client support?
Android 6.0 and later (including Chromebook), iOS 13 and later, Linux (Debian 10 or Fedora 34 and later), macOS 10.14 and later, and Windows, including Windows 10, 11, and several Windows Server versions, though Windows 7 and 8.1 support is limited since Microsoft ended support for those releases.
What was the SASE Client called before?
In earlier software releases – before 7.4.3 for Android, 7.3.7 for macOS, and 7.4.5 for Windows – the same application was branded the Versa Secure Access (VSA) client. The rename reflects Versa’s broader SASE positioning; the underlying client functionality carried forward.
What is the difference between the secure access portal and the secure access gateway?
The portal authenticates the user, registers the device, and pushes configuration, policy, and routes. The gateway is what the client tunnels to afterward for the actual VPN session. Both roles can run on the same VOS device or on two separate devices.
Can the SASE Client be managed from both Director and Concerto?
The client software is the same either way, but a given tenant is managed from one backend at a time: the Versa Secure Access Service configured directly on VOS devices through Director, or secure client-based access rules configured through Concerto.
How does the SASE Client authenticate users?
It supports local and LDAP authentication at the portal, plus two-factor authentication, SMS or email one-time passwords, TOTP, SAML, and certificate-based device authentication – configurable per user, group, region, or device through the secure access profile. Newer releases can also set an authentication order, choosing whether user or device authentication runs first.
More on the SASE Client
If you want to learn more, these are sources we trust.
| Versa Networks products | Versa SD-WAN | Versa Academy |
|---|---|---|
| Versa’s product overview, covering the SASE Client alongside the gateways and policy engine it connects to. | How the SD-WAN and SASE services the client secures are packaged and delivered, from the vendor. | Versa’s training platform, with courses covering SASE Client deployment and secure access configuration. |
Related terms
If you’re reading about the SASE Client, these are worth looking at next.
| Zero Trust | Versa Director | Secure SD-WAN |
|---|---|---|
| The security model the SASE Client enforces: continuous verification of identity and device posture before access. | The console where a Director-managed secure access portal and gateway are configured for the client. | Versa’s networking and security platform that the SASE Client extends to remote users and devices. |