What is VSA?

Versa Secure Access (VSA) is Versa’s client-based secure remote access service, built from a registration portal, a cloud gateway, and an endpoint client. It gives remote users SD-WAN or secure VPN tunnel connectivity into enterprise networks plus secure web gateway internet access. The client component was later renamed the Versa SASE client, but VSA remains the name for the service, gateway, and portal.

Key takeaways

• VSA is a licensed service: registration portal, cloud gateway, and client.
• It delivers SD-WAN or VPN tunnel access plus secure web gateway browsing.
• The endpoint client was renamed Versa SASE client; VSA the service persists.
• Authentication uses Active Directory or the VOS local user database.
• VSA is licensed in Essential and Professional tiers, minimum 50 users.

On this page: Why it matters · How it works · VSA components · VSA & the Versa platform · FAQ

Why is VSA important?

Remote and hybrid workforces need enterprise network access and safe internet browsing without a full site-to-site SD-WAN deployment at every location. VSA answers that by packaging remote access as a licensable service: a user installs a client, registers against an enterprise’s portal, and gets a secure tunnel into corporate resources plus policy-enforced internet access – without an administrator provisioning a branch device for every remote employee.

Because VSA is provisioned and licensed like other Versa SASE gateway services, MSPs and enterprises manage it alongside secure web gateway (SWG) service on the same gateway hardware, from the same Titan Portal or Director workflow used for branch and hub provisioning. That shared provisioning model is what lets a reseller stand up remote-access service for a customer as part of the same gateway order as their SD-WAN service, rather than as a separate product.

What is VSA?

VSA’s architecture has three parts working together: a registration portal that a newly licensed user reaches by email link to bind their client to an enterprise; a cloud gateway that terminates client tunnels and enforces secure-access and SWG policy; and an endpoint client that establishes the tunnel and runs on the user’s device. Authentication against the gateway uses either Microsoft Active Directory or the VOS local user database, with two-factor authentication available for local users.

The client component has a naming history worth knowing: releases before Android 7.4.3, MacOS 7.3.7, and Windows 7.4.5 shipped it as the “Versa Secure Access (VSA) client application,” later renamed the Versa SASE client. The service name VSA, however, continues in current use for the gateway, portal, licensing, and certificates – the rename applied to the client app, not the service.

VSA components

The VSA portal is where a user registers a new device: entering the portal FQDN, enterprise name, and user ID sent by email, after which the client synchronizes its configuration automatically. The VSA gateway is the cloud or on-premises SASE gateway a client tunnels into; firewall and TLS-decryption rules reference it through a dedicated ingress zone (labeled Secure Access or Remote Client) so policy can distinguish VSA traffic from SD-WAN and internet-facing traffic. The VSA client is the endpoint software – now branded the Versa SASE client – supporting Windows, macOS, Linux, iOS, Android, and ChromeOS, configurable for full tunnel (all traffic, including internet, through the VPN) or split tunnel (only enterprise traffic tunneled).

VSA & the Versa platform

VSA is provisioned as a SASE gateway option: a reseller or MSP provisions the license through the Versa MSP portal against a Versa Cloud Gateway, choosing a service tier – Essential or Professional – with a minimum of 50 client users, and configures the resulting service from the Versa Titan Portal. Per-client settings – IPsec tunnel address pool, full or split tunnel, Always On connection, private prefix access, and DNS resolution – are set in the secure access client profile, and a VSA certificate matching the gateway’s device FQDN must be installed before an MSP creates tenants, since tenant creation copies that certificate downstream. Registered clients then run day to day as the Versa SASE client application, the current name for VSA’s endpoint software.

Frequently asked questions

What is the difference between VSA and the Versa SASE client?

VSA is the overall secure remote access service – portal, gateway, and client. The Versa SASE client is the current name for VSA’s endpoint software, renamed from “Versa Secure Access client application” in later releases. VSA as a service name still applies to the gateway, portal, and licensing.

What authentication methods does VSA support?

VSA authenticates against Microsoft Active Directory or the VOS local user database. Two-factor authentication is available but only for local users, not Active Directory accounts, and the client also supports SAML and time-based one-time passwords for portal registration.

Is VSA still an active Versa product, or has it been fully replaced?

VSA remains active as a licensed gateway service – provisioning, certificates, and gateway configuration in current Titan Portal and Director documentation all use the VSA name. Only the endpoint client application was renamed, to the Versa SASE client; the service itself was not discontinued.

What is the difference between full tunnel and split tunnel in VSA?

Full tunnel routes all client traffic, including internet-bound traffic, through the VPN to the gateway. Split tunnel routes only enterprise-destined traffic through the tunnel, letting other traffic use the local internet connection directly – useful when a branch has multiple internet links.

How is VSA licensed?

VSA is licensed as a SASE gateway option in Essential or Professional service tiers, ordered with a minimum of 50 client users. A reseller or MSP provisions the license through the Versa MSP portal against the target Versa Cloud Gateway before configuring the service.

More on VSA

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VSA, these are worth looking at next.