Versa Cloud Gateway (VCG) is a Versa-hosted SASE gateway that terminates SASE client and branch connections, providing authentication, ZTNA-based application access, secure internet access, and SD-WAN overlay connectivity for remote users and sites. A single tenant can be assigned multiple logically isolated VCGs.
Key takeaways
- VCG is Versa’s cloud-hosted gateway for SASE clients and branch tunnels.
- Terminates ZTNA app access, secure internet access, and SD-WAN overlay traffic.
- A tenant can run multiple isolated VCGs, each with its own IP pools.
- Connects to SD-WAN branches and hubs over site-to-site IPsec and BGP.
- Configured and published to gateways from the Versa Concerto GUI.
On this page: Why it mattersHow it worksVCG deployment modelsVCG & the VersaONE platformFAQ
Why is VCG important?
Unified SASE blends WAN Edge (SD-WAN) and Security Service Edge (SSE) into one architecture, and the cloud-hosted half of that blend has to live somewhere. VCG is that somewhere: a Versa-operated gateway that terminates SASE clients, branch site-to-site tunnels, and internet-bound traffic, so remote workers and branch offices get the same policy enforcement whether the SSE side runs on-premises or in Versa’s cloud.
VCG also matters because it makes multi-tenant SASE practical at scale. Each tenant can be assigned its own logically isolated VCG, or several, with dedicated address pools, bandwidth, and encryption settings – without a provider standing up separate infrastructure per customer. For managed service providers, VCG is the resource that dedicated or shared MSP gateway types actually point to.
What is VCG?
VCG is a Versa-hosted appliance running Versa Operating System (VOS), managed by Versa Networks on a separate headend from a customer’s own Versa Director-managed branches and controllers. It terminates two kinds of connections: SASE clients (remote users running the Versa SASE client) and site-to-site tunnels from SD-WAN branches or SSE hubs, typically over IPsec or GRE with EBGP for dynamic routing.
VCGs operate in IKE passive mode – they never initiate a site-to-site tunnel, so the VOS branch or SSE hub on the other end must always be the initiator. Connectivity is configured from Versa Concerto, which owns the VCG side, and Versa Director, which owns the branch or hub side; the two must agree on IKE and IPsec parameters, tunnel addressing, and EBGP AS numbers and policy. Layer 3 symmetric forwarding is enabled on VCGs by default, keeping traffic paths consistent in both directions.
VCG deployment models
A SASE tenant gets a default VCG automatically, named tenant-name-Enterprise, if none is explicitly configured. Enterprises with more complex requirements can configure multiple VCGs per tenant instead; because separate VCGs don’t share information, each can reuse the same client address pool names and even overlapping IP ranges, and administrators assign gateway groups and regions per VCG.
For managed service providers, MSP tenants choose between two gateway types: shared, where the MSP tenant owns no gateways and its subtenants inherit access to the parent tenant’s VCGs, and dedicated, where the MSP tenant’s own VCGs are provisioned directly on Director and later discovered by Concerto.
When a VCG connects to an on-premises SD-WAN SSE hub, the traffic path itself has two models: active-standby, where BGP AS-path prepending and community tagging steer traffic to one preferred VCG with failover to a backup, and active-active, where equal-cost EBGP paths and default Layer 3 symmetric forwarding load-share traffic across both.
VCG & the VersaONE platform
VCG sits on the cloud side of a SASE deployment, provisioned and managed through Versa Concerto rather than Versa Director. Concerto is where administrators create SASE tenants, assign one or more VCGs per region, configure client address pools, and publish the resulting configuration to the gateways. Versa Director continues to own the other end of the connection – the VOS branches and SD-WAN SSE hubs whose site-to-site tunnels terminate on a VCG.
VCG also connects to Versa’s Advanced Security Cloud: tenants with ATP/DLP, clientless access, or remote browser isolation add-ons, configured as part of SASE tenant setup, share cloud-instance details with their VCGs so the gateway can hand off sandboxing traffic to those services. Logging configured per SASE tenant – firewall, web, DNS, and CGNAT logs – flows from the VCG to Versa Analytics or the Advanced Logging Service.
Frequently asked questions
What is the difference between a VCG and a VOS branch?
A VOS branch is a customer-premises or virtual device managed through Versa Director, hosted by the enterprise or its provider. A VCG is the cloud-side counterpart: a Versa-hosted, Versa-managed appliance on a separate headend, configured through Concerto, that terminates the branch’s site-to-site tunnels and SASE client connections.
How many VCGs can a tenant have?
A tenant can be assigned one or more logically isolated VCGs. If none is explicitly configured, Concerto creates a default VCG named after the tenant. Because separate VCGs don’t share information, multiple VCGs on the same tenant can even reuse identical client address pool names and IP ranges.
Who initiates the site-to-site tunnel between a VCG and a branch?
VCGs operate in IKE passive mode and never initiate a site-to-site tunnel. The VOS branch or SD-WAN SSE hub on the other end must always be the initiator; a branch configured in passive mode too leaves the tunnel permanently unestablished.
What is the difference between active-standby and active-active VCG traffic paths?
Active-standby uses BGP AS-path prepending and community tagging so traffic prefers one VCG, with automatic failover to a backup if it fails. Active-active uses equal-cost EBGP paths and default Layer 3 symmetric forwarding to load-share traffic across two VCGs simultaneously.
What is the difference between a shared and a dedicated VCG for an MSP tenant?
A shared MSP tenant owns no VCGs itself; its subtenants inherit access to the parent tenant’s gateways. A dedicated MSP tenant has its own VCGs, provisioned directly on Versa Director and then discovered by Concerto, giving its subtenants access only to those gateways.
More on VCG
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages for the SASE platform VCG delivers, including gateway architecture. | How the SD-WAN service VCG connects into is packaged and delivered, from the vendor. | Versa’s training portal: courses and labs covering SASE tenants, gateways, and cloud connectivity. |
Related terms
If you’re reading about VCG, these are worth looking at next.
| SASE Gateway | Tenant | Branch |
|---|---|---|
| The broader category of gateway VCG belongs to, cloud-hosted or customer-deployed. | The organizational unit a VCG is assigned to, with its own gateways, licenses, and policies. | The SD-WAN site whose site-to-site tunnels terminate on a VCG for SASE connectivity. |