What is a SASE Gateway?

A SASE gateway is a Versa gateway – cloud-hosted by Versa or deployed as a customer- or MSP-owned appliance – that terminates remote-user and site-to-site tunnels, enforces security policy such as TLS decryption, antivirus, IPS, and URL filtering, and brokers access between SASE clients and private or internet destinations.

Key takeaways

• Terminates remote-user and site-to-site tunnels and enforces security policy.
• Deploys as a Versa-hosted cloud gateway or a customer-owned private gateway.
• Service tiers gate which security services and tunnel modes are available.
• Multitenant cloud gateways connect branch devices in an SD-WAN full mesh.
• Private gateways run on CSG700, CSG1000, CSG2500, CSG5000, and vCSG hardware.

On this page: Why it matters · How it works · SASE Gateway deployment models · SASE Gateway & Versa · FAQ

Why is a SASE gateway important?

A SASE gateway is the enforcement point where SASE’s promise – consistent security wherever a user or site connects – actually gets applied. Remote users, branch sites, and private applications all reach each other through the same gateway, so the same firewall, TLS decryption, antivirus, IPS, and URL-filtering policy protects a laptop on a hotel network and a site-to-site tunnel to a data center alike, without separate appliances or separate rule sets to keep in sync.

It matters operationally too. Because Versa’s cloud gateways are multitenant and hosted at data centers across regions, a provider can bring a new customer online without racking hardware – order a service tier, and a tenant is instantiated on the shared gateway. Where compliance or data-residency needs require it, the same architecture deploys as a private gateway on customer-owned hardware instead, so the security model does not change even when the hosting model does.

What is a SASE gateway?

A SASE gateway sits between SASE clients, branch devices, and their destinations, brokering every connection through policy rather than routing it directly. Remote users reach it over Versa Secure Private Access (VSPA) for private applications and Versa Secure Internet Access (VSIA) for general internet traffic; branch devices reach it as an SD-WAN peer, connected in a full mesh alongside other gateways and sites. Firewall, steering, and security rules are defined per SD-WAN, internet, and secure web gateway zone.

Which services a gateway actually enforces depends on its service tier. An Essential tier is the lighter option – commonly firewall and URL filtering, or split-tunnel routing where only specific traffic is redirected to the gateway. A Professional tier adds the full stack – antivirus, IPS, and TLS decryption – and full-tunnel routing, where all client traffic is encrypted and sent through the gateway.

SASE Gateway deployment models

Two deployment models exist. The cloud gateway is Versa-hosted and multitenant: an MSP, reseller, or provider orders it through Titan Portal, and Versa maintains the underlying infrastructure at data centers across the U.S., Japan, and Europe. Standing up a new customer is a licensing operation, not a hardware rollout.

The private SASE gateway is deployed on customer- or MSP-owned hardware – the CSG700, CSG1000, CSG2500, and CSG5000 series, plus virtual cCSG and vCSG appliances – for organizations that need the gateway on their own infrastructure. A private gateway is configured with a site role (hub, hub controller, spoke, or full mesh), WAN and LAN interfaces set before activation, and, for high availability, a VRRP-backed LAN with an IP SLA monitor validating reachability. Ports and VLANs cannot be reassigned once the gateway is activated, so interface planning happens up front.

SASE Gateway & Versa

Provisioning runs through Titan Portal, where an MSP, store admin, or reseller provider creates a site, builds the gateway’s device configuration, deploys it to the Controller node, and activates the appliance – the full sequence is in Configure and Activate SASE Gateway Devices. Ordering a cloud gateway service or a private gateway license for a tenant, including service-tier and bandwidth choices, is covered in the MSP order-management flow in Titan Order Management for MSPs.

Private gateways also require VSA (Versa Secure Access) certificates uploaded after activation before an MSP can create tenants on the device; Titan then copies the certificates to each tenant automatically. Titan Portal 9.1.1 documents this certificate workflow along with firewall and steering rule configuration for both cloud and private SASE gateways.

Frequently asked questions

What is the difference between a cloud SASE gateway and a private SASE gateway?

A cloud gateway is multitenant infrastructure Versa hosts and maintains at its own data centers; ordering one is a licensing step in Titan Portal. A private gateway runs on customer- or MSP-owned CSG hardware, giving an organization the gateway on its own infrastructure for compliance or connectivity reasons.

What is the difference between the Essential and Professional service tiers?

Essential typically covers firewall and URL filtering, or split-tunnel routing where only selected traffic reaches the gateway. Professional adds antivirus, IPS, and TLS decryption, plus full-tunnel routing, where all client traffic is encrypted and sent through the gateway for inspection.

What are VSIA and VSPA?

Versa Secure Internet Access (VSIA) and Versa Secure Private Access (VSPA) are the two services a SASE gateway brokers: VSIA secures general internet-bound traffic, while VSPA secures access to private applications. A single gateway can provide both to the same tenant.

Can a private SASE gateway’s interfaces be changed after activation?

No. LAN and WAN ports, VLAN tagging, and interface assignments must be finalized before activation. Once a private gateway is activated, you cannot add, delete, or reassign LAN or WAN interfaces; the gateway must be deactivated first to make those changes.

Do branch devices connect to SASE gateways directly or through the SD-WAN fabric?

Through the fabric. Branch devices are automatically connected to the available gateways as part of the SD-WAN full mesh, and administrators define steering and firewall rules per zone – SD-WAN, internet, or secure web gateway – rather than pointing individual branches at a single gateway.

More on SASE Gateway

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SASE gateways, these are worth looking at next.