What is VSIA?

Versa Secure Internet Access (VSIA) is the internet-facing half of Versa’s Security Service Edge: it connects users to public clouds, SaaS applications, and the open internet through Versa’s fabric of secure web gateways, consolidating secure web gateway, NGFW-as-a-service, CASB, and DLP capabilities into one licensed service.

Key takeaways

• VSIA is Versa SSE’s internet-access component; VSPA is the private-access half.
• It consolidates SWG, NGFW-as-a-service, CASB, and DLP into one service.
• Versa Cloud Gateways enforce VSIA policy through security VSG functions.
• VSIA ships in Essential, Professional, and Elite tiers with optional add-ons.
• Direct Internet Access (DIA) from gateways is enabled for VSIA by default.

On this page: Why it matters · How it works · VSIA tiers · VSIA & the Versa platform · FAQ

Why is VSIA important?

Backhauling every user’s internet and SaaS traffic to a central data center for inspection adds latency and defeats the purpose of cloud-delivered applications. VSIA solves this by moving internet security to the edge: Versa’s fabric of cloud-hosted secure web gateways inspects and enforces policy on internet-bound traffic close to the user, whether that user is at a branch or working remotely, without forcing every session through a central chokepoint.

It also matters as a consolidation play. Rather than stitching together a secure web gateway, a next-generation firewall, a CASB, and a DLP engine as separate products, VSIA delivers all of them as one subscription enforced at the same gateway – one policy engine, one set of logs, one place to size and license internet-security capacity as the user population grows.

What is VSIA?

VSIA runs on Versa Cloud Gateways (VCGs), which combine networking functions – best gateway selection, per-tenant trusted network detection, routing protocol support, and SLA-based traffic steering – with security functions delivered through the gateway’s secure web gateway (VSG) role: authentication, user and group policy, and NGFW capabilities such as URL filtering, IP filtering, file filtering, and application filtering, layered with SSL/TLS decryption.

VSIA adds three capabilities on top of that SWG core. Traffic identification and policy-based filtering classifies traffic by network location, SASE client version, and predefined or user-defined applications, users, and groups. CASB gives visibility and control over cloud application usage – shadow IT discovery, firewall log ingestion, and compliance management. DLP monitors and can block exfiltration of sensitive data in motion or at rest in cloud repositories. By default, VSIA advertises a 0.0.0.0/0 route to the client, and Direct Internet Access from gateways is enabled – internet-bound traffic exits locally instead of backhauling through a data center route.

VSIA tiers

VSIA is licensed in three tiers. Essential provides baseline coverage without unified threat management (UTM) in Titan Portal’s version-1 licensing model, or with a 10-application cap in version 2. Professional unlocks full UTM and unrestricted application support, plus optional add-ons: API-based data protection, data loss prevention, remote browser isolation, and advanced threat protection (cloud malware sandboxing with antivirus and AI/ML). Elite includes everything in Professional, adds user and entity behavior analytics (UEBA) as an option, and includes data loss prevention by default. API-based data protection and advanced threat protection ship with restricted access unless their matching add-ons are selected.

VSIA & the Versa platform

VSIA is one of two subscription types selectable per rule in Concerto’s secure client-based access rules, alongside VSPA; a rule scoped to VSIA gets the Send Apps to Versa Cloud Gateway traffic action, which routes device traffic to the VCG while letting administrators exclude specific applications or route prefixes from the tunnel. Configuring a SASE tenant is where a provider selects the VSIA product bundle, sets the number of VSIA users and license dates, and caps internet protection rules; VSIA is also one of the three components – alongside VSPA and Premier Secure SD-WAN – bundled into every Versa Secure Access Fabric tier, from Essential through Elite. Endpoint client behavior for VSIA changed materially between Titan Portal’s version-1 and version-2 licensing models – version 1 did not support a VSIA endpoint client at all, while version 2 supports full-tunnel VSIA connectivity through the Versa endpoint client – a distinction covered in VSIA, VSPA, and VSPIA behavior changes.

Frequently asked questions

What is the difference between VSIA and VSPA?

VSIA is the internet-access half of Versa SSE, securing traffic to the internet, public clouds, and SaaS applications. VSPA is the private-access half, brokering ZTNA access to internal applications. VSIA typically runs full tunnel; VSPA typically runs split tunnel.

What tiers does VSIA come in, and what do they add?

VSIA ships as Essential, Professional, and Elite. Essential is baseline coverage; Professional adds full UTM, unrestricted applications, and optional add-ons such as DLP and advanced threat protection; Elite adds UEBA as an option and includes DLP by default.

Does VSIA support a dedicated endpoint client?

It depends on the Titan Portal licensing version. Version 1 (before Release 11.2) did not support a VSIA endpoint client. Version 2 (Release 11.2 and later) supports full-tunnel VSIA connectivity through the Versa endpoint client, which new organizations default to.

What is Direct Internet Access (DIA) and how does VSIA use it?

DIA lets internet-bound and SaaS traffic break out locally at the gateway instead of routing through a central data center. VSIA enables DIA from gateways by default, sending internet-bound traffic out locally rather than over the tenant’s configured default route.

How does VSIA relate to CASB and DLP?

CASB and DLP are capabilities VSIA consolidates rather than separate products. CASB governs cloud application usage – visibility, shadow IT discovery, and compliance. DLP monitors and can block sensitive-data exfiltration. Both run as part of the same VSIA subscription on the same gateway.

More on VSIA

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VSIA, these are worth looking at next.