Secure SD-LAN is Versa’s software-defined architecture for campus and branch local-area networks, unifying switching, routing, and security in one system. It applies Zero Trust access control and microsegmentation across secure switches and WLAN access points, extending the same on-premises protection enterprises already use for remote access to the physical LAN itself.
Key takeaways
- Secure SD-LAN is the LAN half of Versa’s Zero-Trust LAN (ZT-LAN) architecture.
- Delivers microsegmentation and Zero Trust access control at the LAN edge.
- Runs on VOS across the CSX4000 and CSX8000 secure switch families.
- Pairs with ZT Edge for a complete on-premises ZTNA solution.
- Managed through Versa Director, Concerto, and Analytics like the rest of VOS.
On this page: Why it mattersHow it worksSecure SD-LAN componentsSecure SD-LAN & the VersaONE platformFAQ
Why is Secure SD-LAN important?
Legacy campus and branch LANs were built for a world where employees worked from one desk on one wired connection. That model breaks down for a hybrid workforce: legacy LAN gear lacks comprehensive built-in security, has no real protection against east-west attacks between devices on the same network, and cannot deliver a true software-defined perimeter. Layer 2 switching adds its own limits – single active paths, slow convergence, and proprietary vendor technologies – while switching, WLAN, WAN edge, and security are typically managed as separate, siloed tools that are complex to operate and prone to interoperability problems.
Secure SD-LAN exists to close that gap. It brings the Zero Trust model enterprises already apply to remote users – verify first, trust nothing implicitly – back onto the physical campus and branch network, with microsegmentation fine-grained enough to isolate a compromised laptop, IoT sensor, or unmanaged device without disrupting the rest of the LAN.
What is Secure SD-LAN?
Secure SD-LAN is one of two components of Versa’s ZT-LAN solution, alongside ZT Edge (which delivers the software-defined perimeter and on-premises ZTNA enforcement). Where ZT Edge focuses on admitting and verifying users and devices, Secure SD-LAN is the software-defined campus and branch fabric itself: standards-based switching and access infrastructure with microsegmentation built in, so devices can be isolated by type, security posture, or status rather than relying on coarse VLAN boundaries alone.
Both components run on the Versa Operating System (VOS), delivered through the Director-Controller-Analytics (DCA) complex, with Versa Concerto providing a single portal that manages SD-LAN, security, and SD-WAN together. A distinguishing property of the model is policy mobility: once a device is admitted and a security policy applied, that policy follows the device around the campus regardless of which switch port or wireless access point it connects through next.
Secure SD-LAN components
Secure SD-LAN runs on two families of Versa Cloud Services Switches (CSX), each combining a merchant Ethernet switch chipset with an x86 processor subsystem for policy enforcement at line rate. The CSX4000 series – comprising the CSX4300 and CSX4500 – serves the LAN edge and access layer, with PoE++ port density (up to 48 ports) for endpoints like phones, cameras, and access points. The CSX8000 series – comprising the CSX8300 and CSX8500 – serves aggregation and core roles in campus or data-center locations, with up to 32 QSFP28 100-Gigabit Ethernet ports and multi-terabit switching capacity. WLAN access points extend the same enforcement to wireless clients.
For brownfield sites where replacing existing switches and APs isn’t practical, Versa offers a ZT-LAN policy enforcement appliance instead: all third-party LAN traffic is routed through it for Zero Trust enforcement. This deployment avoids some of the east-west visibility that a native VOS edge deployment provides, but still delivers unified policy, single-pane visibility, and reduced complexity compared to siloed legacy tools.
Secure SD-LAN & the VersaONE platform
Within VersaONE, Secure SD-LAN sits alongside Secure SD-WAN, SSE, and next-generation firewall as one of the converged services the platform delivers from a single VOS software stack. It shares the same management plane as every other VersaONE service: Versa Director for configuration and templates, Versa Concerto for the unified portal, and Versa Analytics for network and security telemetry. Commercially, Secure SD-LAN is licensed separately from Secure SD-WAN and standalone NGFW – a customer can deploy Secure SD-WAN, Secure SD-LAN, or both, on the same Versa headend without paying for orchestration capacity twice.
Frequently asked questions
What is the difference between Secure SD-LAN and ZT Edge?
They are the two components of Versa’s ZT-LAN solution. Secure SD-LAN is the software-defined switching and access fabric with microsegmentation; ZT Edge is the on-premises ZTNA layer that authenticates and admits users and devices. Enterprises can deploy either independently or together as full ZT-LAN.
What hardware runs Secure SD-LAN?
Versa Cloud Services Switches: the CSX4000 series (CSX4300, CSX4500) for LAN edge and access, and the CSX8000 series (CSX8300, CSX8500) for aggregation and core roles. WLAN access points extend the same policy enforcement to wireless clients on the same campus fabric.
Can Secure SD-LAN be deployed without replacing existing switches?
Yes. In brownfield sites, a Versa Zero Trust policy enforcement appliance can be inserted into the existing LAN so that third-party switch and access-point traffic is routed through it for enforcement, though this provides less east-west visibility than native VOS switches at the edge.
Does Secure SD-LAN require Secure SD-WAN?
No. Secure SD-LAN, Secure SD-WAN, and NGFW are licensed and deployed as separate solution lines that share the same Versa headend and VOS software. A customer can run Secure SD-LAN on its own, Secure SD-WAN on its own, or both together.
What happens to security policy when a device moves around the campus?
The policy follows the device. Once a device or user has been identified and admitted with a given security posture, that same policy applies regardless of which wired port or wireless access point it connects through next, with no manual re-provisioning or re-authentication required at each new attachment point.
More on Secure SD-LAN
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including where Secure SD-LAN fits among Versa’s converged services. | The sibling SD-WAN service Secure SD-LAN shares a headend and licensing model with. | Training and labs covering Versa’s SD-LAN and Zero Trust LAN capabilities. |
Related terms
If you’re reading about Secure SD-LAN, these are worth looking at next.
| Microsegmentation | VersaONE | Zero Trust |
|---|---|---|
| The granular isolation technique Secure SD-LAN applies to devices and users on the campus LAN. | The Universal SASE platform that converges Secure SD-LAN with Secure SD-WAN, SSE, and NGFW. | The security model – never trust, always verify – Secure SD-LAN brings on-premises to the LAN. |