Versa Smart Aggregator is a component placed between agentless devices and Versa SASE Gateways, providing port aggregation and tenant-aware load balancing of traffic as part of a SASE Gateway POP – the piece of Versa’s Private SASE architecture that lets mobile and wireline subscribers reach SASE Gateways without running a SASE agent on their device.
Key takeaways
- Sits between agentless devices and Versa SASE Gateways in a POP.
- Provides port aggregation and tenant-aware load balancing of traffic.
- Built from redundant Versa CSX switches and Versa CSG devices.
- Core to Versa’s agentless SASE-on-SIM solution for MNOs and telcos.
- Keeps return traffic symmetric by pinning flows to one SASE Gateway.
On this page: Why it mattersHow it worksVersa Smart Aggregator componentsVersa Smart Aggregator & VersaFAQ
Why does Versa Smart Aggregator matter?
Agentless SASE – securing mobile or wireline subscribers who can’t or won’t run a SASE Client – needs something in front of the SASE Gateways that can identify which tenant a device belongs to and route its traffic accordingly, without adding per-tenant infrastructure. This is a service-provider problem specifically: mobile network operators want to sell a SASE service without standing up a dedicated Access Point Name or gateway pool per customer, and Versa Smart Aggregator is what avoids that, consolidating aggregation and load balancing into one tenant-aware layer in front of a shared pool of SASE Gateways.
Because it’s tenant-aware, one Smart Aggregator can serve many tenants’ traffic without dedicated per-tenant paths. And because it load-balances across both local and remote SASE Gateways, it also provides resiliency if a local SASE POP has an issue – protecting availability, not just spreading load.
What is Versa Smart Aggregator?
Versa Smart Aggregator sits inside the SASE Gateway POP, the building block responsible for security enforcement in Versa’s SASE-on-SIM solution – an extension of Versa’s Private SASE architecture built to deliver SASE features to agentless devices, such as mobile subscribers identified by IMSI, or wireline subscribers over DOCSIS or xDSL identified by circuit ID, without a SASE agent running on the device.
Traffic from an agentless device arrives at the Smart Aggregator over a network-to-network interface from the access network. Aware of IP-to-tenant mappings supplied by the Versa Messaging Service, the aggregator selects a SASE Gateway for that tenant and forwards the traffic, creating a reverse-flow entry so return traffic comes back through the same gateway. The SASE Gateway then enforces that tenant’s security policy before routing to the internet, and return traffic from the internet also traverses the Smart Aggregator to preserve that symmetry.
Versa Smart Aggregator components
A Versa Smart Aggregator is not a single box. It’s composed of a minimum of two Versa CSX switches for port aggregation and a minimum of two Versa CSG devices for tenant-aware load balancing – both minimums exist for redundancy, and the architecture is horizontally scalable as gateway pools grow.
Inside and between SASE Gateway POP components, connectivity runs over EVPN/VXLAN, the industry-standard overlay Versa uses to keep multiple tenant VPNs, like internet or cellular-network paths, scalable within the POP. The Smart Aggregator’s SASE Gateway POP pairs with a separate SASE Headend POP – hosting Versa Concerto, Director, Messaging Service, Analytics, and Controller – connected over a Versa SD-WAN overlay for control-plane flows such as Director’s access to the gateway devices.
Versa Smart Aggregator & Versa
Smart Aggregator’s tenant awareness depends on the rest of the SASE-on-SIM headend: Versa Concerto provisions the tenant, device identity, and security policy; that configuration is pushed through Versa Director to the SASE Gateways; and Versa Messaging Service relays identity-to-IP mapping, learned through IMSI or circuit-ID provisioning, so both can classify traffic correctly.
Versa Analytics collects logs and telemetry from the gateway pool for reporting, and Versa Controller provides the control-plane entry point the SASE Gateways use. The number of SASE Gateway POPs – and therefore Smart Aggregators – a deployment runs is driven by geographical resiliency and latency requirements, while the number of Headend POPs is driven by headend-level resiliency needs.
Frequently asked questions
What does Versa Smart Aggregator do?
It sits between agentless devices and Versa SASE Gateways, providing port aggregation and tenant-aware load balancing so traffic from many tenants can share one pool of SASE Gateways without dedicated per-tenant infrastructure, while keeping return traffic pinned to the gateway that handled the outbound session.
What is an agentless device, in the context of Smart Aggregator?
A device that reaches SASE services without running a SASE Client – typically a mobile subscriber identified by IMSI, or a wireline subscriber over DOCSIS or xDSL identified by circuit ID. Smart Aggregator and the SASE Gateways learn that identity from the Versa Messaging Service.
What hardware makes up a Versa Smart Aggregator?
A minimum of two Versa CSX switches for port aggregation and a minimum of two Versa CSG devices for tenant-aware load balancing, deployed redundantly. The architecture is horizontally scalable, so capacity grows as the SASE Gateway pool behind it grows.
How does Versa Smart Aggregator keep traffic symmetric?
When it forwards a flow to a SASE Gateway, it creates a reverse-flow entry so return traffic from the internet is sent back through that same gateway rather than a different one in the pool, preserving the session state the gateway enforces policy against.
Can Versa Smart Aggregator provide resiliency across sites?
Yes. It can load-balance traffic between SASE Gateways in both the local SASE POP and remote SASE POPs, which spreads load and also protects availability if a local SASE POP has an issue, since traffic can shift to gateways elsewhere.
More on Versa Smart Aggregator
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa SD-WAN | Versa Academy |
|---|---|---|
| Versa’s product pages, including the SASE Gateway and CSG/CSX hardware families a Smart Aggregator is built from. | How Versa packages Private SASE and SD-WAN together, the architecture Smart Aggregator’s SASE-on-SIM solution extends. | Versa’s training portal, with courses covering SASE architecture and gateway POP design in more depth. |
Related terms
If you’re reading about Versa Smart Aggregator, these are worth looking at next.
| SASE Gateway | Tenant | Versa Director |
|---|---|---|
| The component Smart Aggregator load-balances traffic toward, and the device that enforces each tenant’s security policy. | The isolated customer unit whose IP-tenant mapping Smart Aggregator uses to route traffic to the correct gateway. | The headend console that pushes tenant and security-policy configuration through to the SASE Gateways behind the aggregator. |