What is SD-LAN?

SD-LAN is the secure local-area-networking component of the VersaONE Universal SASE platform, integrated alongside SD-WAN, NGFW, SASE, and SSE to securely connect users, devices, workloads, and networks. It runs on VOS-based Ethernet switches, configured through Director workflow templates that define switch ports, security profiles, and access policies.

Key takeaways

• SD-LAN is VersaONE’s secure LAN pillar, alongside SD-WAN and SSE.
• Runs on VOS switches: the CSX4300, CSX4500, and CSX8300 families.
• Director workflow templates configure ports, profiles, and ACL policies.
• Supports EVPN-VXLAN, 802.1X authentication, and switch multihoming.
• Combines with ZT Edge to form Versa’s Zero-Trust LAN solution.

On this page: Why it matters · How it works · SD-LAN components · SD-LAN & VersaONE · FAQ

Why is SD-LAN important?

Campus and branch LAN switching has traditionally been managed separately from the WAN and security stack – a different console, a different policy model, often box-by-box CLI work per switch. SD-LAN closes that seam by bringing Ethernet switching into the same VOS software, Director templates, and headend architecture that already run SD-WAN, so a single team and a single operational model cover both the wide-area fabric and the local network.

It also moves security to where users and devices actually connect: the access port. Port-level 802.1X authentication and ACL policy mean a switch can enforce identity and access control at the edge, rather than trusting anything inside the building and filtering later. That access-layer enforcement is the foundation Versa’s Zero Trust LAN designs build on, and template-driven deployment gives it the same operational scale – reusable configuration pushed to many switches – that made SD-WAN manageable at scale.

What is SD-LAN?

SD-LAN configuration starts with a workflow template on the Director node: an administrator selects the switch model (CSX4300, CSX4500, CSX8300, or a VM form factor), the organization and any sub-organizations, the Controller node or nodes that will manage the switch, the licensing solution tier, and the Analytics cluster that receives its logs. Director’s configuration wizard walks through each step and deploys the finished template to activate the switch.

From there, physical ports are configured as either Layer 2 switching interfaces – access or trunk mode, with VLAN assignment – or Layer 3 routed interfaces with static or DHCP-assigned IPv4/IPv6 addressing. Layer 3 ports can also enable VXLAN, advertising the interface and its network into an EVPN/VXLAN fabric so Layer 2 domains can extend across sites over a routed core.

SD-LAN components

A template’s building blocks fall into three groups. Ports are the physical and virtual interfaces: Layer 2 and Layer 3 physical ports, aggregated Ethernet interfaces built with LACP link aggregation, switch management interfaces for remote administration, and IRB interfaces that route between a Layer 3 network and a Layer 2 bridge domain.

Profiles are reusable settings attached to ports: 802.1X profiles for port-based authentication, multihoming profiles (MC-LAG) that let an access switch connect redundantly to more than one upstream device, and physical port profiles covering features like Power over Ethernet and LLDP. Policies are ACL rules that control what traffic a port or switch permits. Underneath all of it sits the switch hardware itself – Versa’s CSX family spans edge and access appliances up through aggregation and core switching roles.

SD-LAN & VersaONE

SD-LAN is one of VersaONE’s converged pillars, built on the same VOS software and the same Director-Controller-Analytics headend that orchestrates SD-WAN: Director templates configure the switch, a Controller node manages it, and an Analytics cluster ingests its telemetry – the identical operational model, just applied to LAN switching instead of branch routing.

Paired with ZT Edge, SD-LAN forms Versa’s Zero-Trust LAN (ZT-LAN) solution, delivering Zero Trust Network Access and microsegmentation for campus and branch networks. Endpoint information profile (EIP) based microsegmentation extends this further, letting Versa SASE clients connect in gateway-assisted trusted-network mode so remote and on-premises access enforce the same identity-aware policy.

Frequently asked questions

What is the difference between SD-LAN and SD-WAN?

SD-WAN is the wide-area layer: branch and hub VOS devices form IPsec and MP-BGP tunnels to a Controller across diverse transports. SD-LAN is the local-area layer: Ethernet switch ports, VLANs, and access policy on VOS-based switches at a site. Both share the same Director-Controller-Analytics headend model.

What switch hardware runs Versa SD-LAN?

Versa’s CSX family of VOS-based Ethernet switches runs SD-LAN, including the CSX4300, CSX4500, and CSX8300 models plus a VM form factor for virtual deployments. The broader CSX2000, CSX4000, and CSX8000 series extend the family across edge, access, aggregation, and core switching roles.

How is SD-LAN configured?

Administrators use a guided configuration wizard on the Director node, building a workflow template that captures the switch model, organization, licensing, and Controller assignment. They then configure physical and virtual ports, attach security profiles, and apply ACL policies before deploying the template to the switch.

What is the relationship between SD-LAN and Zero-Trust LAN?

Zero-Trust LAN (ZT-LAN) is Versa’s broader on-premises LAN solution. It combines Secure SD-LAN with ZT Edge to deliver Zero Trust Network Access, microsegmentation, and software-defined campus and branch networking on top of VOS-based switches and access points – SD-LAN supplies the switching layer that ZT-LAN’s policy model runs on.

Does SD-LAN support VXLAN and EVPN?

Yes. SD-LAN Layer 3 ports can enable VXLAN, a data-plane encapsulation that carries Ethernet VPN (EVPN) traffic over a routed IP network. Enabling it advertises the port’s interface and network into the EVPN/VXLAN fabric, extending Layer 2 domains across a routed core.

More on SD-LAN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SD-LAN, these are worth looking at next.