What is Secure SD-WAN?

Secure SD-WAN – Versa Secure SD-WAN – is Versa’s WAN-edge product line: physical and virtual customer premises equipment (CPE) that combines software-defined WAN routing with an integrated next-generation firewall, sold in Essential, Professional, and Elite solution tiers, and orchestrated through Versa Director or Versa Concerto as part of the VersaONE platform.

Key takeaways

• Secure SD-WAN converges SD-WAN routing with a built-in NGFW.
• Three solution tiers – Essential, Professional, Elite – layer on features.
• CPE licensing is capacity-based, not tied to WAN bandwidth (2025 model).
• Both Versa Director and Versa Concerto orchestrate Secure SD-WAN CPE.
• IPsec tunnels stitch Secure SD-WAN branches into unified SASE with SSE.

On this page: Why it matters · How it works · Secure SD-WAN solution tiers · Secure SD-WAN & the VersaONE platform · FAQ

Why is Secure SD-WAN important?

The branch WAN edge is where a network meets the internet, and traditionally that meant stacking a router, a firewall, and separate SD-WAN hardware in one rack. Secure SD-WAN exists to collapse that stack: one piece of CPE handles carrier-grade routing, SD-WAN path selection, and NGFW-class security together, so a site doesn’t need a second appliance for firewalling and threat protection.

The tiered model matters just as much as the convergence. Essential, Professional, and Elite map features to actual deployment needs instead of forcing every customer onto one bundle, and the 2025 licensing model prices by device capacity rather than metered WAN bandwidth, removing overage risk. Because every CPE is orchestrated centrally through Director or Concerto, a design built once – routing, QoS, security policy – rolls out identically across a fleet, which is what makes Secure SD-WAN operable at hundreds or thousands of sites.

What is Secure SD-WAN?

Secure SD-WAN is the WAN Edge component of Versa’s SASE architecture: it connects branch offices and home offices to private data centers, clouds, and the internet, while Secure Access and Secure Web Gateway cover remote users and cloud/SaaS access respectively. Each Secure SD-WAN device is a piece of CPE – physical or virtual – running the Versa Operating System (VOS), and every CPE deployed, including HA pairs, requires its own capacity-based software subscription license. Licensing has three dimensions – solution tier (features), appliance model (capacity), and subscription duration (one, three, or five years, paid upfront). The capacity basis is what the 2025 model changed: licenses before 2025 were sized by purchased WAN bandwidth tier, from 10 Mbps up to 100 Gbps, measured at the 95th percentile of monthly usage.

Under the hood, Secure SD-WAN pairs core SD-WAN functions – encrypted VPN overlays, application identification, application-aware traffic management, and SLA-based path measurement – with L4-7 NGFW features: stateful firewall, IKEv2 IPsec, CGNAT, and URL/IP reputation filtering. Administrators configure it through Versa Director’s device templates or Versa Concerto’s tenant-based profiles, both covered by the Versa Secure SD-WAN Integration with Versa SSE configuration guide.

Secure SD-WAN solution tiers

Versa groups Secure SD-WAN features into three solution tiers. Essential provides carrier-class routing and switching, wired/wireless interfaces (LTE, 5G, Wi-Fi), zero-touch provisioning, core SD-WAN functions, and L4-7 security: stateful firewall, DoS protection, CGNAT, IKEv2 IPsec, URL/IP reputation, and an SSL/TLS proxy scoped to captive-portal use (general HTTPS inspection for scanning arrives in Elite). Professional adds application-experience features on top of Essential: MOS-based traffic management, forward error correction, packet striping, direct internet/cloud access optimization, TCP optimization, and IoT device identification. Elite adds unified threat management (UTM) on top of Professional – full-scope TLS proxy, file reputation filtering, intrusion prevention (IPS), antivirus and malware protection, and 60 GB per CPE of Versa’s cloud-delivered Advanced Logging Service – eliminating the need for a separate firewall appliance. Add-on licenses layer further capability onto any tier, including on-premises ZTNA, an identity engine, and XoT device fingerprinting (an add-on on Essential; included in Professional and Elite), and, on Elite only, inline CASB/DLP data protection and cloud-based ATP sandboxing.

Secure SD-WAN & the VersaONE platform

Secure SD-WAN CPE is orchestrated by the Versa Orchestration suite: Director, Controller, and Analytics are minimum requirements, while Concerto and the Messaging Service are recommended additions. Every 2025 license includes right-to-use, multitenant, cloud-hosted orchestration by default, with dedicated cloud-hosted or fully on-premises orchestration available for an additional license when data sovereignty or regulatory requirements call for it – on-premises orchestration is sized from 250 up to 20,000 managed CPEs, dedicated cloud-hosted from 500 up to 20,000 – and the orchestration capacity purchased is independent of, and can exceed, the number of CPE licenses actually bought.

For unified SASE, Secure SD-WAN and Versa SSE run together on Versa’s cloud. Where Secure SD-WAN is instead hosted by a service provider or enterprise, IPsec (or GRE) tunnels stitch it to Versa-hosted SSE components – Secure Access for remote workers, Secure Web Gateway for SaaS and internet traffic – reaching the same coherent SASE outcome through a different architecture.

Frequently asked questions

What is the difference between Secure SD-WAN and Versa SSE?

Secure SD-WAN is the WAN Edge piece: routing, path selection, and NGFW security for offices and branches running on CPE. Versa SSE (Secure Access and Secure Web Gateway) secures remote users and cloud/SaaS access. Combined, they form Versa’s SASE architecture.

Which Secure SD-WAN tier includes intrusion prevention?

Intrusion prevention (IPS), full-scope TLS proxy, antivirus, and malware protection are Elite-tier features, layered on top of everything included in Professional and Essential. Essential and Professional cover stateful L4-7 firewalling and application-experience optimization, but neither includes the full unified threat management stack Elite adds.

How is 2025 Secure SD-WAN licensing priced?

By device capacity rather than WAN bandwidth: each CPE model has a fixed usage ceiling under its subscription, so customers can use up to that capacity without overage charges. Subscriptions run one, three, or five years, and each CPE needs its own license, including HA pairs.

Can Secure SD-WAN be managed without deploying orchestration on-premises?

Yes. Every 2025 Secure SD-WAN license includes right-to-use, multitenant, cloud-hosted orchestration by default, so no on-premises Director, Controller, or Analytics deployment is required to get started. Dedicated cloud-hosted or fully on-premises orchestration remain available as paid options where data-sovereignty or regulatory requirements call for them.

How does Secure SD-WAN connect to a third-party SSE provider?

Administrators build IPsec site-to-site tunnels from the Secure SD-WAN branch, configured in Versa Director, to the third-party cloud, using static routes or BGP with BFD for failover. Versa’s own documentation covers Zscaler, Netskope, and Microsoft Entra Internet Access integrations built the same way.

More on Secure SD-WAN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about Secure SD-WAN, these are worth looking at next.