Solution Components

Secure SD-WAN 

SD-WAN technology forms the foundation of a SASE solution by enabling optimal performance and intelligent routing in a client-to-cloud network architecture. Versa Secure SD-WAN provides a seamless SASE architecture, including visibility into traffic traversing the network between users, applications, and devices regardless of their location. Leveraging Versa Networks automation, you can manage the complete lifecycle of Versa Operating System^TM (VOS^TM) devices from a single pane of glass, in just a few clicks. Zero-touch provisioning (ZTP) enables complete orchestration of VOS devices in the cloud and significantly reduces cloud instantiation times and operational involvement. Versa Secure SD-WAN eliminates multicloud complexity by automating dynamic multicloud overlay connectivity from any user, device, or branch.

Versa Secure SD-WAN offers extensive capabilities including the following:

• Subsecond packet steering across multiple WAN interfaces
• Packet loss reduction through services such as forward error correction (FEC), packet replication, and avoidance of poorly performing links
• Encrypted and unencrypted overlays with MPLS/GRE or VXLAN
• SD-WAN Controller node
• WAN circuit support
• Full-mesh and hub-and-spoke topologies
• Dynamic IPsec overlays
• Direct internet access (DIA)
• HTTP and HTTPS proxy

You can deploy a Secure SD-WAN topology quickly, in conjunction with legacy infrastructure, as shown in the following figure.

Secure SD-WAN supports native sandboxing, both on-premises and cloud-delivered, which supports malware analysis for Windows OS and for mobile devices, including iOS and Android. Native sandboxing malware analysis is performed as follows:

• Check cloud-based reputation to match previously known deny lists and allow lists for the file checksum database.
• If a reputation-based match for the file is not found, use the built-in antivirus engine to scan the file for malware.
• Perform static analysis on the file to check for matches against known threat vectors.
• Process the file against the YARA rule engine to check for matches with previously known malware and malware variants.
• Based on the preprocessing of the files, reduce the number of files that are submitted to the malware sandbox for behavior analysis.
• Execute or open the submitted files in the malware sandbox to analyze the behavior of the payload.
• Monitor for activity using various techniques in the MITRE ATT&CK framework.
• Automatically generate a full behavior-analysis report for the payloads.
• Detect zero-day malware, in most cases within a few seconds, to block malicious files from being downloaded.
• Provide alerts and notifications about malicious files that take longer for the malware sandbox to analyze.

Versa Secure Access

Versa Secure Access (VSA) is a secure solution that connects an organization's employees working from anywhere to enterprise applications hosted in the enterprise environment, private clouds, or public clouds. VSA protects applications and users using zero-trust network access (ZTNA). VSA is a cloud-managed, cloud-delivered private access service that connects distributed users with distributed applications without compromising security or user experience. The fundamental philosophy of ZTNA is to verify each network access by the user. In the context of secure access, the ZTNA requirements translate to the following:

• Application segmentation to restrict access of the applications
• Enterprise-grade authentication with multifactor authentication (MFA)
• Per-user or user group–based application control
• Network obfuscation and hiding of topology
• Application and network visibility

The VSA solution is built on the SASE framework of integrating security, identity management, cloud, and SD-WAN into a hassle-free service that extends perimeter protection to the end-user device, delivers an always-on application experience, and is highly scalable and extensible to allow users to work from anywhere.

The following figure illustrates the VSA solution.
 

The VSA solution consists of the following components:

• Versa Cloud Gateways (VCG)—VCGs are globally distributed to provide distributed secure on-ramps for access to enterprise applications. Gateways authenticate users, authorize the application access, and secure the enterprise network from external threats. VCGs are built on VOS that integrates advanced routing, comprehensive security, and market-leading SD-WAN along with secure access.
• Versa client—A software agent or application that runs on and extends SD-WAN to client devices, and provides SD-WAN–lite capability on the client side. The Versa SASE client creates a secure and encrypted connection from a remote device to the VCG. After authentication and access authorization through the VCG, users can use the SASE client to securely connect to enterprise applications in public and private clouds.
• Versa Secure Access portal—Allows enterprise administrators to monitor the service and leverages the Versa Analytics platform to provide real-time and historical network, application, and user-level reporting.

The following are the key capabilities of VSA:

• Microsegmentation—VSA uses microsegmentation to control and limit the application visibility to authorized users. Users can be configured to use the Versa SASE Client to connect to different gateways for different applications. An application-and-gateway combination is dynamically configured for a seamless application experience and it provides an additional level of security by preventing the user from accessing gateways that are not accessible or are not preferred for the application. Support for multiple gateways enables you to dedicate certain gateways for secure applications while allowing users to access generic applications from other gateways.
• User authentication and authorization—VSA leverages the enterprise’s preferred identity provider to authenticate and authorize the user. VSA integrates with various types of authentication servers such as Active Directory, SSO servers such as OKTA, and authentication protocols such as LDAP and SAML. The enterprise Identity is used to authorize the users for application access policies. VSA supports MFA using email and time-based OTP (TOTP) integration with Duo, Google Authenticator, and Microsoft Authenticator.
• Application firewall—VSA enforces policies that authorize access to applications based on user or user group. You can define applications using fully qualified domain names (FQDNs), hostnames, wildcards, IP address subnets and ports, or a combination of these. The policies are based on the username or group information received during authentication from enterprise identity servers.
• Network obfuscation—This security technique hides the internal network topology from remote users, thus protecting applications from multiple attack vectors such as lateral movement and port scanning. Versa Cloud Gateway obfuscates the application server IP address from the user and user IP address from the application server. The user traffic is authorized and translated towards the application and vice versa. This provides the highest level of protection from malicious actors on the internet.
• Application and user visibility—Application, user, and network visibility is necessary to efficiently operate the network and to secure it from external threats. VSA builds on the big-data–based Versa Analytics platform to provide network administrators with real-time and historical reporting about users, applications, and the network.
• Assured application experience—Versa Secure SD-WAN ensures application experience for users, no matter where they connect from. VSA applies techniques such as SLA monitoring, traffic engineering, and FEC to this software-based service.
  • Intelligent gateway selection ensures that the SASE client connects to the gateway that provides the best user experience. 

• VSA supports traffic steering based on applications, FQDNs, and routes. Traffic-steering policy determines traffic breakout, gateway selection, and whether encryption is required for traffic tunneled towards the gateway.
• VSA supports the creation of encrypted and unencrypted tunnels towards cloud gateways. Unencrypted tunnels provide better latency characteristics for real-time traffic that might support application-level encryption. 

Secure Web Gateway

The Versa SASE secure web gateway (SWG) integrates full-stack security; identity management; cloud application security and SSL encryption and decryption; Versa Secure Access; and SD-WAN into a simple service that runs in the cloud, on-premises, or a mix of the two.

Versa SWG protects enterprises and users from malicious web traffic access and infection, and contamination by hijacked websites that contain malware or viruses. Based on the user, device, and location context, SWG evaluates application policy and grants access only if the policy allows the request based on identity context.

Versa Cloud Gateways are hosted around the globe and offer a variety of SASE services. When you subscribe to the SWG service, you leverage VCGs around to globe to secure the web and mobile traffic originating from the network users and remote users.

Versa SWG offers full security suite, including URL reputation and filtering, IP reputation and filtering, DNS reputation and filtering, Layer 7 (application-based) rules, SSL/TLS decryption, NG IPS, antivirus, DNS filtering, and file filtering.

The Versa SWG solution comes with a unified policy framework with single-touch deployment including sites that are leveraging Versa Secure SD-WAN. The Versa policy framework covers devices and applications independent of deployment and access, providing simpler policy deployment, configuration, and management through an automated and centralized policy engine.

Versa SWG provides the following features:

• Enterprise-grade device and user authentication with MFA.
• User-, group-, and device-level access control and policies—Active Directory, ID-Proxy integration to manage traffic by users.
• URL-based traffic identification—URL traffic management for millions of sites managed by categorization into 83 classes by type, risk and other factors, including encrypted HTTPS flows.
• Identification of applications with features such as deep packet inspection (DPI), URL, protocol and port numbers, and destination IP addresses, combined with comprehensive policy-based control.
• Next generation firewall (NGFW), DOS protection, CGNAT with application-level gateway (ALG) support.
• Web filtering to prevent traffic flow to undesired, out of compliance, illegal, or virus/malware-spreading sites.
• Comprehensive unified threat management including NG-IPS, antivirus, file filtering, malware protection, and sandboxing capabilities.
• SSL-TLS proxy to terminate encrypted sessions and to apply detailed security scans to ensure no vulnerability or malware hides within encrypted flows while enforcing security policies defined by the network administrator.
• DNS proxy and DNS security to secure and manage DNS inquiries and resolutions.
• Identity proxy and integration with third-party identity management services along with an enterprise’s identity management systems.
• Supports a rich set of routing protocols to enable traffic routing and management decisions.
• SD-WAN support provides an integrated, secure WAN-edge solution for enterprise branch, HQ, and DC WAN sites, enabling enterprises to choose the placement and management of security functions on-premises, on-cloud, or both, all managed through a single pane of glass.
• Flexibility to deploy mixes of thin branch and thick cloud, thick branch and thin cloud, or other options based on requirements.
• Seamless integration option with Versa Secure Access (VSA) to provide comprehensive security to VSA clients while using encrypted, private access to the network.
• Single-pass architecture for maximum performance and lowest latency.

Cloud Access Security Broker

Cloud Access Security Broker (CASB) is cloud-based policy enforcement software that secures the data flowing between users and cloud applications to comply with corporate and regulatory requirements. CASB applies enterprise security policies when users access cloud-based resources.

CASB addresses the following challenges to securing data as more applications move to the cloud:

• Implement data-centric policies to authorize or control.
• Analyze data access and changes to data stored in software-as-a-service (SaaS) clouds.
• Implement access control for files, applications, and users.
• Identify user downloads, uploads, and file sharing.

In addition, CASB secures cloud services and the growing deployment of direct cloud-to-cloud access.

The VOS CASB implementation functions as inline software, leveraging the VOS deep packet inspection (DPI) software to monitor user activity, enforce security policies, and provide granular access control for cloud applications. Versa Networks also supports API integration with SaaS applications. This API integration makes use of API calls to SaaS applications, inspects user activities and contents, enforces security policies, and provides granular access control for SaaS applications.

SWG protects internal resources from malicious activity. For example, URL filtering or DNS security protects internal users from accessing websites that violate the company policy or are potentially harmful to the enterprise. CASB is complementary to the SWG, as the primary role of CASB in the enterprise security architecture is to protect data, focusing on data stored in cloud platforms. 

Inline CASB acts as a gateway in the path of users accessing the data seamlessly and uses some of the following techniques:

• Identity provider proxy—Managed SaaS offerings are configured with the CASB provider as the identity proxy. When a user tries to access a cloud resource, the authentication request is forwarded to the CASB provider, which forwards it to an identity provider (for example, PingID or OKTA) for authentication. After successful authentication, the request is redirected to the CASB provider. The CASB provider becomes the path in between by proxying the user access to the cloud service. This mechanism ensures that the user accessing the cloud service, using any device, is always redirected to the CASB server.
• When the enterprise network has proxy deployed, the CASB server can be proxy chained. The enterprise has to configure on-premises or cloud-based proxy to redirect the cloud applications to the CASB provider. Any user accessing the cloud application is scanned by the CASB provider. 
• GRE/IPSec tunnels from on-premises appliances can also be utilized to tunnel the traffic to the CASB server.
• Reverse Proxy PAC files.
• Once the CASB server is in the path of user access, every API call, file upload or download, and configuration change are verified with the policy. The CASB server now has information, such as user information, historical activity, user baseline, access location, and time of day, to take an informed decision about the risk of certain activities.

Versa inline CASB is implemented by enhancing the Versa deep packet inspection (DPI) engine. It monitors user activity, enforces security policies, and provides granular cloud application access control.

You can create multiple CASB profiles and each profile can have multiple CASB rules. Each CASB rule can be configured to match the risk level and activity of multiple cloud applications and you can deny or restrict access to shadow IT. A CASB profile can be referenced for action by a security access policy rule. On matching a CASB rule in the profile, further processing can be performed using antivirus, file filtering, DLP, and sandboxing profiles.