What is SD-Security?

SD-Security is Versa Networks’ software-only, multitenant security solution that layers integrated security services – firewall, threat prevention, and content filtering – into a Versa SD-WAN deployment. It runs anywhere in the fabric, at the branch, in the cloud, or in the data center, under policies managed centrally from Versa Director.

Key takeaways

• Software-only: no dedicated security hardware to buy or maintain.
• Deploys anywhere in the fabric – branch, hub, cloud, or data center.
• Layers NGFW, file filtering, DNS filtering, and antivirus natively.
• Managed centrally from Director, with globally enforced policy.
• Certified by ICSA Labs, NSS Labs, ONUG, and VMware Ready for NFV.

On this page: Why it matters · How it works · SD-Security deployment models · SD-Security & the VersaONE platform · FAQ

Why is SD-Security important?

Security has traditionally meant a stack of dedicated appliances – a firewall here, an IPS there, a secure web gateway bolted on afterward – each purchased, licensed, and managed separately from the network that carries the traffic. SD-Security collapses that stack into software that runs as part of the same VOS instance already forwarding SD-WAN traffic, so control-plane and data-plane paths are inspected inline, without another box in the chain.

Because SD-Security is multitenant and carrier-class, one deployment can serve many isolated organizations with independently managed control, security, and threat policy – the property that lets service providers deliver managed security alongside managed SD-WAN instead of standing up separate stacks per customer. Centralized policy means a rule written once at Director is enforced identically everywhere it applies: branches, hubs, and data centers, on premises or in the cloud.

What is SD-Security?

SD-Security is the security layer of Versa’s software stack, not a separate appliance: it runs inside VOS on whichever branch, hub, gateway, or cloud instance needs it. Its layered services include native NGFW and UTM functions, file filtering (by type, size, protocol, and direction, with SHA-256/SHA-384 hash allow and deny lists plus cloud-based reputation lookups), DNS filtering (allow/deny lists, DNS-tunneling detection, and newly-observed-domain reputation lookups), and antivirus scanning of web and email traffic.

Policy and threat content are managed centrally: control, security, and threat policies are authored once and pushed globally, and dynamic threat intelligence – IP addresses, ports, and URLs – can be kept current across the fleet by tools like VSync, which distributes updated feeds to SD-Security devices without routing that traffic through Director itself. The solution holds certifications including ICSA Labs Firewall, NSS Labs NGFW/NG-IPS/SSL-Proxy, ONUG SD-WAN and SD-Security Top 10, and VMware Ready for NFV.

SD-Security deployment models

SD-Security adapts to where enforcement is needed. Inline with SD-WAN is the default: branch and hub VOS nodes apply SD-Security to the same IPsec-over-VXLAN tunnels carrying control-plane and data-plane traffic, so overlay paths are secured without extra hops. Standalone firewall deploys a VOS instance purely as a security enforcement point – in virtual-wire, Layer 2, or Layer 3 mode – for sites that need firewalling without full SD-WAN. Cloud and data-center deployments extend the same policy model to workloads off premises, protecting north-south and east-west traffic alike. Multitenant provider deployments isolate control, security, and threat policy per organization on shared infrastructure.

SD-Security & the VersaONE platform

SD-Security is one of three solution pillars – alongside SD-WAN and SD-Branch – that the Versa Secure Cloud IP Platform delivers as software-defined Layer 3 through Layer 7 services. Every SD-Security instance runs as part of VOS, the same operating system underlying SD-WAN and SD-Branch, so a single appliance can carry all three without separate licensing per function. Versa Director provisions and monitors SD-Security policy fleet-wide, and utilities like the VSync tool keep external threat feeds synchronized to every SD-Security device so enforcement stays current without manual updates.

Frequently asked questions

What is the difference between SD-Security and a traditional firewall appliance?

A traditional firewall is a dedicated box inspecting traffic that passes through it. SD-Security is software running inside the same VOS instance already carrying SD-WAN traffic, so firewalling, threat prevention, and content filtering happen inline without a separate device, and policy is centrally managed rather than box-by-box.

Does SD-Security require dedicated security hardware?

No. SD-Security is explicitly software-only – it runs on the same x86-based VOS appliance, virtual instance, or cloud node handling SD-WAN or SD-Branch functions. There is no proprietary security appliance to rack, license, or maintain separately from the rest of the network.

How does SD-Security get updated threat intelligence?

Enterprises maintain threat intelligence – IP addresses, ports, URLs – on web or REST API servers. Tools like VSync automatically detect updates to those sources and distribute the consolidated data directly to SD-Security VOS devices, bypassing Director so updates stay fast and Director’s own operations are unaffected.

Can SD-Security be deployed for multiple tenants on one system?

Yes. SD-Security is carrier-class and multitenant by design: control, security, and threat policies are scoped per organization, so a single deployment can serve many isolated customers, each managed independently, which is central to how service providers deliver managed security services.

What certifications does SD-Security hold?

SD-Security has been certified by ICSA Labs for stateful firewall and DoS protection, by NSS Labs for NGFW, NG-IPS, and SSL-Proxy, against the ONUG SD-WAN and SD-Security Working Groups’ verified Top 10 requirements, and as VMware Ready for NFV certification.

More on Versa SD-Security

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SD-Security, these are worth looking at next.