Versa Operating System (VOS) is the software stack that runs on every Versa physical and virtual appliance, integrating SD-WAN, routing, next-generation firewall security, quality of service, multitenancy, and analytics collection into a single operating system. The same VOS image runs identically on branch, hub, gateway, and Controller nodes, whatever the underlying hardware or cloud.
Key takeaways
- VOS is the single software stack behind every Versa appliance.
- It converges SD-WAN, routing, NGFW security, and QoS in one OS.
- The same VOS image runs on physical and virtual appliances alike.
- Versa Director and Concerto orchestrate and configure VOS devices.
- VOS devices are activated via zero-touch provisioning or cloud-init.
On this page: Why it mattersHow it worksVOS deployment modelsVOS & the VersaONE platformFAQ
Why is VOS important?
VOS is what makes a Versa appliance a single coherent device rather than a stack of separate boxes for routing, firewalling, VPN termination, and traffic shaping. Every one of those functions runs inside one operating system, sharing one session table, one policy engine, and one management interface, instead of being stitched together from multiple vendors’ point products. That convergence is what lets a branch office replace a router, a firewall, and a WAN optimizer with one appliance.
It also matters because VOS is the same software everywhere. A physical branch appliance, a virtual instance running in a public cloud, and a Versa-hosted cloud gateway all run the same VOS codebase, so a feature or security policy configured once behaves identically regardless of where the device sits. Multitenancy is built into the OS itself, so a single VOS device can serve many isolated customer organizations, which is what makes shared-infrastructure SASE and managed SD-WAN services economically viable for providers.
What is VOS?
VOS combines several functions that would otherwise be separate appliances. SD-WAN traffic steering and encrypted overlays connect branches, data centers, and clouds; dynamic routing protocols such as BGP and OSPF exchange reachability across the fabric; a next-generation firewall enforces stateful, application-aware, and identity-based security policy alongside IDS/IPS, URL and DNS filtering, and advanced threat protection; QoS and NAT/CGNAT shape and translate traffic; and per-tenant routing instances keep customer organizations isolated on shared hardware. VOS devices also generate their own logs and telemetry, exported to Versa Analytics for dashboards, reports, and troubleshooting.
VOS devices do not configure themselves. Versa Director – or Versa Concerto in SASE deployments – pushes template-based configuration down to each device and monitors its status, so the OS is the execution layer beneath a centralized management plane rather than something administered box by box.
VOS deployment models
VOS runs in three principal forms. Physical appliances are Versa’s hardware CPE and gateway devices – CSG- and CSX-family appliances deployed at a branch, hub, or data center – activated through zero-touch provisioning methods such as global ZTP, URL-based ZTP, or USB-based ZTP. Virtual appliances package the same VOS software as a virtual machine image for private or public cloud infrastructure, such as Microsoft Azure, and are typically onboarded using cloud-init rather than physical staging.
A third form, the Versa Cloud Gateway (VCG), runs VOS on infrastructure hosted and managed by Versa Networks itself, on a headend separate from the customer’s own devices. A VOS branch – physical or virtual – builds IPsec site-to-site tunnels to a VOS VCG to reach Versa-hosted SSE services, which is how Secure SD-WAN and Security Service Edge stitch together into a unified SASE architecture.
VOS & the VersaONE platform
VOS is the appliance-level layer of VersaONE, sitting beneath Versa Director‘s orchestration and Versa Analytics‘s telemetry collection. Director pushes device and service templates to VOS devices and tracks their running configuration; Analytics ingests the logs VOS devices export to build dashboards and reports; Controller nodes anchor the SD-WAN fabric that VOS devices establish tunnels into. For step-by-step onboarding of new VOS hardware and virtual instances, see Activate VOS Devices; for how a VOS branch integrates with Versa-hosted SSE through a VOS VCG, see Versa Secure SD-WAN Integration with Versa SSE.
Frequently asked questions
What is the difference between VOS and Versa Director?
VOS is the operating system running on the appliance itself – SD-WAN, routing, firewall, and QoS execute there. Versa Director is the separate management console that configures, monitors, and orchestrates VOS devices through templates. VOS does the forwarding and enforcement; Director tells it what to enforce.
Does the same VOS software run on physical and virtual appliances?
Yes. The same VOS codebase runs on physical CSG- and CSX-family hardware and on virtual appliance images deployed in private or public cloud infrastructure. Features and policy configured through Director behave the same way regardless of which form factor the device runs on.
How is a new VOS device activated?
Physical VOS devices are activated through zero-touch provisioning – global ZTP, URL-based ZTP, CLI-based staging, or USB-based ZTP – depending on the access an administrator has to the device. Virtual VOS appliances are typically onboarded automatically using cloud-init in their cloud environment.
What is a Versa Cloud Gateway (VCG)?
A VCG is a VOS instance hosted and managed by Versa Networks on its own headend, rather than by the customer. VOS branch devices build IPsec site-to-site tunnels to a VCG to reach Versa-hosted SSE services, integrating on-premises SD-WAN with cloud-delivered security.
Does VOS support multitenancy?
Yes. Multitenancy is native to VOS: a single device can host multiple isolated customer organizations, each with its own routing instances, policies, and administrators. This is what lets service providers run many customers on shared VOS hardware without cross-tenant visibility or interference.
More on VOS
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages describing the appliances and services VOS powers, across editions and form factors. | How the Secure SD-WAN service built on VOS is packaged, licensed, and delivered, straight from the vendor. | Versa’s training portal: courses and labs covering VOS configuration, from onboarding to advanced policy. |
Related terms
If you’re reading about VOS, these are worth looking at next.
| Appliance | Versa Director | Next-Generation Firewall |
|---|---|---|
| The physical or virtual device – a branch, hub, gateway, or Controller node – on which VOS actually runs. | The centralized management console that configures, monitors, and orchestrates VOS devices through templates. | The integrated security capability inside VOS combining stateful filtering, application awareness, and IPS. |