Deploy an SSE Gateway and Onboard Tenants Using Concerto

Create a Template Workflow for the SSE Gateway

You must create a separate template workflow for each SSE gateway. You cannot use the same template for multiple gateways.

To create a template workflow for the SSE gateway:

1. In Director view, select the Workflows tab in the top menu bar.
2. Select an organization. 
3. Select Template > Templates in the horizontal menu bar, and then click the  Add icon.
4. In workflow step 1, Basic, enter information for the following fields. 
   
   
    

   Field	Description
   Name (Required)	Enter a name for the template.
   Device Type (Group of fields)	Select the Cloud Security device type name, and select Hub Controller as device type.
   Organization (Required)	Select a provider organization.
   Solution Tier (Required)	Select Premier Elite SD-WAN.

5. Select workflow step 3, Tunnels.
6. To configure split tunnels for direct internet access (DIA), enter information for the following fields.
   
    
    

   Field	Description
   Split Tunnels (Group of Fields)
   VRF Names	Select the name of the virtual routing and forwarding (VRF) instance.
   WAN Interfaces	Select the name of the WAN interface. If you select more than two WAN interfaces from the same LAN VR to configure DIA, the interface that is first on the list has the highest priority unless you enable load balancing by clicking Load Balance.
   Direct Internet Access	Click to enable DIA. Source NAT is performed before packets are sent out to the WAN interface.
   Add icon	Click the  Add icon to add the split tunnel to the template.

7. Click Save to save the configuration, or click Step 7, Review. The Step 7, Review screen displays.
8. Click Save to add the template.
9. Click Deploy to activate the post-staging template.

For detailed information on creating a workflow template, see Create and Manage Staging and Post-Staging Templates.

Configure a Public WAN IP Address for a Gateway Behind a NAT Device

If a gateway does not have a public IP address on its WAN interface, use a static public IP address. If you cannot use a static IP address, configure the public IP address in the device template after deploying the workflow.

To configure a public WAN IP address:

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Templates in the horizontal menu bar.
   3. Select an organization in the left navigation bar.
   4. Select a template from the dashboard. The view changes to Template view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > SD-WAN > System > Site Config in the left menu bar.
   
   
4. Click the  Edit icon.
5. In the Edit Site Config window, click the WAN interface.
6. In the Edit WAN Interfaces window, enter information for the following fields.
   
   
    

   Field	Description
   Circuit Tags	Enter the following predefined circuit tags: NO_DIA—Disables DIA on the WAN interface for all tenants deployed on the gateway. Use this for private WAN circuits like MPLS or dedicated internet circuits. NO_S2S—Prevents the WAN circuit from being used for site-to-site tunnels by tenants. NO_RAC_RAS—Restricts the WAN interface from connecting Versa SSE clients to the gateway. DIA_ON_PROVIDER—Enables source CGNAT translation for the sub-tenant’s internet traffic on the transport-VR side within the provider tenant context. Use this only in specific use cases. If no circuit tags are used, the WAN interface is used for site-to-site tunnels, remote Versa SASE client connections, and DIA traffic.
   IPv4 Tab	Select the IPv4 tab.
   Public IP Address	Enter the public WAN IP address.

Update the CGNAT Rule to Perform Source NAT on the Transport VR

If Lightweight Directory Access Protocol (LDAP) is reachable over the WAN IP address of transport VR, you must add the destination zone associated with the internet circuit in the carrier-grade NAT (CGNAT) rule match criteria. This ensures that any traffic originated on the gateway is captured and translated to the WAN IP address to reach customer LDAP/AD servers on the internet.

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > CGNAT in the left menu bar.
4. In the main pane, select the Rules tab. The tab displays the rules that are already configured.
   
   
5. Select the CGNAT rule to edit.
6. In the Edit CGNAT Rule window, select the Match > Destination tab.
7. In the Destination Zones section, click the  icon, and then select the destination zone. 
   
   
8. Click OK.

Create a Device Group for the SSE Gateway

You must create a separate device group for each SSE gateway. For the device group name, use the following the naming convention: <GW-name>-dg. For example, saseGW4-br4-dg.

To create a device workflow and deploy the device, see Configure Basic Features.

To create a device group:

1. In Director view, select the Configuration tab in the top menu bar.
2. Select Devices > Device Groups in the horizontal menu bar.
3. Click the  Add icon to add a device group.
   
   
4. In the Add Device Group window, enter information for the following fields.
   
   
5. Deploy the device workflow for the gateway. 
6. If you select a device group on which URL-based ZTP is enabled, perform the zero-touch provisioning (ZTP) process. For more information, see Activate VOS Devices.

Certificate Requirements

The SASE client establishes connections to the SSE gateway using multiple fully qualified domain names (FQDNs), such as the portal FQDN and group FQDN. To handle these HTTPS connections, the SSE gateway requires a device certificate that includes all FQDN variants used.  

• You must use a public certificate authority (CA) to sign the end-entity (device) certificate for SSE gateways. This ensures trusted SSL or TLS connections for client-based and clientless access without installing additional root certificates on user devices.
• When managing FQDNs with multiple hierarchical levels, ensure that all required sub-domains are explicitly included in the certificate or covered by appropriate wildcard entries. For example, a certificate for *.example.com does not include deeper-level hierarchies such as *.sub.example.com. To avoid SSL or TLS validation failures, include all required sub-domains in the certificate's subject alternative name (SAN) section. The following table provides examples of wildcard domain matching.
   

  Wildcard Entry in Certificate	Matches	Does Not Match
  *.example.com	app.example.com mail.example.com  sub.example.com	example.com a1.app.example.com
  *.sub.example.com	app.sub.example.com	sub.example.com a1.app.sub.example.com

• To ensure the SSE gateway certificate is valid for supported access methods, it must include the appropriate FQDN entries to support both client-based and clientless connectivity: 
  • For secure access: *.<sse-root-domain.com> 
  • For reverse proxy: *.myapps.<sse-root-domain.com> 
• Ensure that you generate separate certificates for each redundant SSE gateway, with different expiration dates, to avoid both gateway certificates expiring at the same time.
• You must obtain a wildcard certificate for root domains with extended key usage Server Authentication as shown in the following figure.

  

Certificate Installation

Before onboarding sub-tenants, install the certificates that will be used by all tenants for client access communication at the system level on all gateways. The certificate files must adhere to the following naming conventions: 

• <gw-name>.crt—Gateway certificate file.
• vsa-default-ca-chain.crt—Use the exact filename for CA certificate chain file.
• <gw-name>.key—Private key file for the gateway certificate.

You can copy certificate files to a gateway using the shell or CLI commands.

For example, to copy all certificate files to the /var/tmp/setup_certs directory and set the appropriate permissions, use the following shell commands:

$ mkdir /var/tmp/setup_certs

$ scp versa@10.40.N.N:~/setup_certs/* /var/tmp/setup_certs

$ cd /var/tmp/setup_certs/

$ sudo chmod 755 *

For example, to import CA chain, private key, and gateway certificate, use the following CLI commands. For the private key and gateway certificate commands, replace the <gw-name> with the hostname of your gateway.

$ cli
> request crypto pki ca-chain import name vsa-default-ca-chain.crt filepath /var/tmp/setup_certs/vsa-default-ca-chain.crt

> request crypto pki private-key import filepath /var/tmp/setup_certs/<GW-NAME>.key name <GW-NAME>.key pkey-type RSA> > 

> request crypto pki certificate import name <GW-NAME>.crt priv-key <GW-NAME>.key ca-chain vsa-default-ca-chain.crt filepath /var/tmp/setup_certs/<GW-NAME>.crt

Modify Captive Portal Settings to Allow Port 443 and Update the SASE Domain

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > Captive Portal in the left menu bar. The dashboard displays the captive portal settings.
   
   
4. Click  Edit icon. The Edit Captive Portal Settings window displays.
5. Click the  Add icon to add a service endpoint.
   
   
6. In the Service Endpoint window, enter information for the following fields.
   
   

   Field	Description
   Routing Instance (Required)	Select the routing instance (VRF) to use to access the captive portal pages. If you do not select a routing instance, captive portal pages are enabled only in the global routing instance.
   HTTPS Port	Enter the number of the HTTPS port to use to redirect captive portal pages over HTTPS. Default: 443
   IP Address	Click the  Add icon to add a service endpoint IP address. Any traffic destined to these IP addresses are serviced by the captive portal. Captive portal redirection that is based on the server URL is routed to one of these IP addresses.
   Server (Group of Fields)
   URL	Enter the URL of the proxy autoconfiguration (PAC) file to configure a URL proxy. A PAC file defines how web browsers can automatically choose the appropriate proxy server to fetch a given URL. You can upload PAC files to a VOS device. For more information, see Upload PAC Files.
   Certificate	Select the certificate to use for the PAC URL.

Update SPack and Application Engine Protocol Bundle

• To update security package (SPack) to the premium version on the SSE gateway from Versa Director, see Use Security Packages (SPacks).
• To upgrade the application engine protocol bundle on the SSE gateway, see Use Security Packages (SPacks).

Configure DNS

To configure DNS at the system level:

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Others > System > Domain Name Servers in the left menu bar. The main pane displays the configured DNS servers.
   
   
4. Click the  Add icon. In the Add Name Servers popup window, enter information for the following fields.
   
   
    

   Field	Description
   Routing Instance (Required)	Select the routing instance.
   Source Interface	Select the source interface to use to send DNS requests to the DNS server. You must select at least one source interface or one source network.
   Source Network	Select the source network to use to send DNS requests to the DNS server. You must select at least one source interface or one source network.
   Name Servers (Required)	Click the  Add icon to add DNS servers. You can configure a maximum of the name servers.
   Search Domain	Click the  Add icon to add domain names to search while performing a hostname lookup. You can configure a maximum of six domain names.

5. Click OK.

Configure Time Settings

You can configure the time settings on a VOS device or Controller node. You can configure the VOS device to use an NTP server for time synchronization, or set the time manually. You can also configure the VOS device to act as an NTP server.

Configure QAT on a Supported Platform

To enable QAT on a supported platform, configure crypto accelerator support at the platform and service levels using the following CLI commands:

• For platform level support: set system platform crypto-accelerator-support true
• For service level support: set system service-options crypto-accelerator-support true

For example:

Gateway-01$ cli
Gateway-01-cli> configure
Gateway-01-cli(config)% set system platform crypto-accelerator-support true
Gateway-01-cli(config)% commit

Gateway-01$ cli
Gateway-01-cli> configure
Gateway-01-cli(config)% set system service-options crypto-accelerator-support true
Gateway-01-cli(config)% commit

To verify the QAT status on a platform, use the following command:

Gateway-01$ vsh connect vsmd
vsm-vcsn0> show ipsec qat status

Configure the Root Domain for an SSE Deployment

You can use the SSE setting to specify the root domain for your SSE deployment. Gateway FQDNs are automatically generated based on the root domain value.

To configure the root domain for an SSE deployment:

1. In the service provider home screen, select Settings > SSE.
   
   
2. In the SSE Infrastructure Settings screen, select the General tab, and enter information for the following fields.
   
   
    

   Field	Description
   Use Tenant Name in GW FQDNs	Click the  toggle to use the tenant name in the SSE gateway FQDNs.

3. Click Save.

Onboard Tenants on SSE Gateway

To onboard tenants on an SSE gateway, see Configure SASE Tenants.