What is a Virtual CSG (vCSG)?

A Virtual CSG (vCSG) is the software form factor of Versa’s Cloud Services Gateway: the same VOS-based branch and SASE gateway function delivered as a virtual machine instead of dedicated hardware. It runs on a hypervisor or in a public cloud VPC – Versa Titan documents deployment to AWS – and is sized as Medium, Large, XL, or 2XL.

Key takeaways

• vCSG is the VM form factor of the Cloud Services Gateway (CSG).
• Sizes are vCSG-Medium (4 vCPU), -Large (8 vCPU), and -XL (16 vCPU).
• vCSG-2XL is required to deploy high-availability vCSG pairs.
• Deployed and licensed through the Versa Titan Portal, not by hand.
• vCSG-L and vCSG-XL can also be provisioned as SASE gateway devices.

On this page: Why it matters · How it works · vCSG deployment models · vCSG & the VersaONE platform · FAQ

Why is a Virtual CSG important?

Not every branch or gateway role has a rack to put an appliance in. A regional office already running a hypervisor, or an organization that wants its WAN edge to live in the same VPC as its cloud workloads, needs the CSG’s SD-WAN and security function without the physical box. The vCSG exists for exactly that case: it puts the identical VOS software that runs on physical CSG hardware into a virtual machine, so design, policy, and operational behavior carry over unchanged from a hardware deployment.

It also removes lead time from the equation. A physical CSG has to be manufactured, shipped, and racked; a vCSG instantiates from an image the moment a cloud VPC or hypervisor host is ready, through the same Versa Titan workflow that orders and activates physical hardware. That matters most for elastic or cloud-adjacent deployments, and for MSPs standing up SASE gateway capacity on demand rather than waiting on a hardware order.

What is a Virtual CSG?

A vCSG is a VOS instance packaged to run as a guest VM rather than on dedicated silicon. In the AWS deployment path documented by Versa Titan, the instance runs from a Versa-provided Amazon Machine Image (AMI) inside a customer VPC, provisioned through CloudFormation templates that Titan generates automatically; the customer supplies the VPC, subnet, and LAN interface mapping the vCSG must match before deployment. The same VOS feature set – SD-WAN path selection, routing, and, on capable sizes, integrated security – applies inside the VM exactly as on hardware.

Ordering and lifecycle both run through Versa Titan Portal rather than direct hypervisor administration: an MSP, store admin, or reseller selects a vCSG SKU, a software license tier, and a subscription duration, and Titan handles instance creation, licensing, and activation against the Versa Controller.

vCSG deployment models

vCSG comes in four sizes, selected by SKU or, in the AWS flow, by instance type: vCSG-Medium (4 vCPU), vCSG-Large (8 vCPU), and vCSG-XL (16 vCPU) cover standard branch or gateway capacity, while vCSG-2XL is the size required to configure a high-availability vCSG pair. Role is the other axis: most vCSG sizes serve as a standard branch device, but vCSG-L and vCSG-XL are also qualified as SASE gateway devices, offering Versa Secure Web Gateway (SWG) and Versa Secure Access (VSA) services alongside the SD-WAN role. Gateway types – private gateway, multitenant, and multitenant RAC/RAS – are available on the L, XL, and 2XL sizes but not on vCSG-M. See Add Devices Using Titan Portal for the exact SKU-to-capability mapping.

vCSG & the VersaONE platform

Like every CSG form factor, a vCSG runs VOS and is orchestrated the same way a physical appliance is: through Versa Director/Controller for configuration and control-plane connectivity, with Versa Titan Portal layered on top for MSP-driven ordering, licensing, and cloud-account management. Titan’s Cloud Management System (CMS) connector links a customer’s AWS account to the portal so licenses can be dragged onto a site honeycomb and deployed without manual cloud-console work. The Titan Portal 9.1.1 guide documents the full device catalog – CSG, cCSG, vCSG, Dell, and Whitebox – that Titan provisions through one consistent workflow.

Frequently asked questions

What is the difference between a vCSG and a physical CSG?

A physical CSG is dedicated appliance hardware; a vCSG runs the same VOS software as a virtual machine on a hypervisor or in a cloud VPC. Both support the same SD-WAN and security feature set – the difference is the form factor, not the capability.

What is the difference between vCSG and cCSG?

Both are software form factors of the Cloud Services Gateway. vCSG deploys as a full virtual machine on a hypervisor or cloud VPC; cCSG deploys as a container on a customer-managed cloud server. Sizes and gateway roles are documented separately for each.

What sizes does vCSG come in?

Four: vCSG-Medium (4 vCPU), vCSG-Large (8 vCPU), vCSG-XL (16 vCPU), and vCSG-2XL. The 2XL size is specifically required when configuring a high-availability vCSG pair rather than a single standalone instance. Titan Portal exposes these as selectable SKUs or, in the AWS flow, as EC2 instance types.

Can a vCSG act as a SASE gateway?

Yes, on the L and XL sizes. A vCSG-L or vCSG-XL can be provisioned as a SASE gateway device offering Versa Secure Web Gateway and Versa Secure Access services, in addition to its standard SD-WAN branch role.

How is a vCSG deployed to AWS?

Through Versa Titan Portal: the customer prepares an AWS VPC and LAN subnets, Versa provides a VOS AMI for the account, and Titan automates EC2 instantiation via CloudFormation once the license is dragged onto a site in the Configure dashboard.

More on Versa products

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about the Virtual CSG, these are worth looking at next.