F Step-by-Step Guide to Setting Up a Versa SD-WAN Device - The Network DNA: Networking, Cloud, and Security Technology Blog
Home / Versa SDWAN / Step-by-Step Guide to Setting Up a Versa SD-WAN Device

Step-by-Step Guide to Setting Up a Versa SD-WAN Device

September 07, 2026
🌐⚡🛡️

Complete Configuration Walkthrough — Versa FlexVNF, VOS, Director & Analytics

Versa Networks SD-WAN Setup VOS Configuration SASE Network Security
 Article Type: Technical Deep-Dive  |  ⏱ Read Time: ~18 min  |   Level: Intermediate to Advanced
Last Updated: 2025  |  Versa VOS 22.x / 21.x Compatible
⚡ QUICK ANSWER — What AI & Search Engines Want You to Know

Setting up a Versa SD-WAN device involves 7 major phases: (1) Pre-installation planning and licensing, (2) Installing Versa Director and Analytics, (3) Deploying Versa FlexVNF (VOS) on the branch device, (4) Configuring WAN transport links (MPLS, broadband, LTE), (5) Building SD-WAN policies and application steering rules, (6) Enabling security services (NGFW, ZTNA, SWG), and (7) Validating and monitoring the deployment via the Director GUI and Analytics dashboard.

Versa SD-WAN is a cloud-native, software-defined networking platform that integrates SD-WAN, SASE, NGFW, ZTNA, and analytics in a single VOS (Versa Operating System) stack — making it fundamentally different from hardware-only WAN solutions.

 Table of Contents
  1. What Is Versa SD-WAN? — Architecture Overview
  2. Pre-Deployment Planning & Requirements
  3. Step 1 — Install & Configure Versa Director
  4. Step 2 — Install Versa Analytics (VAN)
  5. Step 3 — Deploy Versa FlexVNF / VOS on Branch Devices
  6. Step 4 — Configure WAN Transport & Underlay Links
  7. Step 5 — Build SD-WAN Overlay (TLOC & VPN Tunnels)
  8. Step 6 — Configure SD-WAN Policies & Application Steering
  9. Step 7 — Enable Security Services (NGFW, ZTNA, SWG)
  10. Step 8 — QoS, SLA Monitoring & Performance Tuning
  11. Troubleshooting Common Versa SD-WAN Issues
  12. Versa vs Fortinet SD-WAN — Key Differences
  13. FAQ — Top Questions from Google & ChatGPT

What Is Versa SD-WAN? — Architecture & Core Components


Versa SDWAN

Versa Networks SD-WAN is an enterprise-grade, cloud-native software-defined wide area network solution built on the Versa Operating System (VOS). Unlike traditional WAN solutions, Versa delivers SD-WAN, security (NGFW, SWG, ZTNA), and analytics from a single unified software stack — making it a leading SASE (Secure Access Service Edge) platform recognized by Gartner.

VERSA SD-WAN ARCHITECTURE
⚙
Versa Director
Centralized Management & Orchestration
Versa Analytics (VAN)
Real-time Telemetry & Reporting
FlexVNF / VOS
Branch CPE (Hardware or Virtual)
☁
Versa Cloud Gateway
Cloud / SaaS Connectivity Hub
↑ All components communicate via encrypted control-plane channels over NETCONF / REST API ↑

 Core Components Explained

⚙ Versa Director
The centralized management and orchestration controller. Provides the GUI, REST API, and NETCONF interface for provisioning, policy management, and lifecycle management of all VOS nodes. Can be deployed on-premise (VM) or in the cloud.
 Versa Analytics (VAN)
Real-time telemetry and big-data analytics engine. Collects flow records, application performance metrics, security events, and SLA data from all VOS nodes. Provides per-application visibility, custom dashboards, and AI-driven anomaly detection.
 Versa FlexVNF / VOS (Branch CPE)
The data-plane node running VOS software. Deployed as a virtual machine (KVM, VMware, Hyper-V), cloud instance (AWS, Azure, GCP), or purpose-built hardware appliance (Versa CSG series, third-party x86). Handles SD-WAN forwarding, security inspection, QoS, and tunneling.
☁ Versa Titan / Cloud Gateway
Cloud-hosted service for branch-to-cloud and direct internet breakout. Provides SWG (Secure Web Gateway), ZTNA, CASB, and cloud-native SD-WAN PoPs for optimized SaaS (Microsoft 365, Salesforce, Zoom) connectivity.

 Pre-Deployment Planning & Requirements

Before deploying any Versa SD-WAN component, a thorough planning phase is critical to ensure a successful rollout. Answer these key questions before touching any hardware or software.

 Pre-Deployment Checklist

✅
Licensing & Subscription: Obtain Versa Networks licenses — SD-WAN Base, Security Bundle (NGFW, SWG, ZTNA), and Analytics. Licenses are tenant-based and applied in Director.
✅
Hardware / Platform Selection: Choose CPE form factor — Versa CSG (1000/5000 series), x86 whitebox, KVM VM, VMware VM, or cloud instance. Size vCPU, RAM, and storage based on throughput requirements.
✅
WAN Transport Inventory: Document all WAN links per site — MPLS, broadband internet, LTE/5G. Note IP addressing, bandwidth, latency characteristics, and provider SLA parameters.
✅
IP Address Planning: Define management IP ranges for Director, Analytics, and each VOS node. Plan overlay IP space (loopback/TLOC addresses) and tenant VPN address pools.
✅
Topology Design: Choose hub-and-spoke, full mesh, or partial mesh topology. Define data center (Hub) and branch (Spoke) roles. Determine if cloud gateways are needed.
✅
Security Policy Design: Map application flows, define traffic segmentation (VRF/VPN), identify applications requiring DPI inspection, URL filtering, or IPS.
✅
DNS & NTP: Ensure all components have working DNS resolution and NTP synchronization. Time accuracy is critical for certificate validation and log correlation.
✅
Software Versions: Download matching VOS, Director, and Analytics software versions from the Versa customer portal. Always use compatible version bundles.

 Minimum System Requirements

Component vCPU RAM Disk Notes
Versa Director 4–8 vCPU 16–32 GB 200 GB SSD HA pair recommended for production
Versa Analytics 8–16 vCPU 32–64 GB 500 GB – 2 TB Scale disk based on retention period & node count
FlexVNF (Small Branch) 2–4 vCPU 4–8 GB 40–60 GB Up to 1 Gbps throughput
FlexVNF (Hub/DC) 8–32 vCPU 16–64 GB 80–200 GB 10+ Gbps throughput with DPDK
Versa CSG Hardware Built-in Built-in eMMC / SSD CSG1000 (branch), CSG5000 (hub)

① Step 1 — Install & Configure Versa Director

Versa Director is the brain of the SD-WAN deployment. It must be installed and fully operational before any VOS node can be onboarded. Director can be deployed as a VM on VMware ESXi, KVM, or as a cloud instance.

1.1 — Deploy Director VM

1
Download Director ISO/OVA from the Versa customer portal at support.versa-networks.com. Select the version matching your deployment (e.g., VOS 22.1.x).
2
Deploy the OVA/VM on your hypervisor. For VMware: File > Deploy OVF Template. For KVM: virt-install --import --disk versa-director.qcow2. Assign the required vCPU, RAM, and disk resources.
3
Initial console login — Login with default credentials: admin / versa123. You will be prompted to change the password immediately.
4
Configure management interface using the setup wizard or via CLI:
VERSA DIRECTOR — INITIAL CLI SETUP
# Run initial configuration wizard
admin@versa-director# setup

# Or configure manually via Versa CLI:
set management ip 192.168.1.10/24
set management gateway 192.168.1.1
set management dns-server 8.8.8.8
set management ntp-server pool.ntp.org
set hostname versa-director-01

# Set management interface
set interface mgmt0 ip 192.168.1.10/24
set interface mgmt0 gateway 192.168.1.1

# Apply and save
commit
save

1.2 — Access Director GUI & Apply License

1. Open a browser and navigate to https://<director-management-ip>:9182. Accept the self-signed SSL certificate warning on first login.
2. Login with Administrator credentials. Navigate to Administration > License and upload the license file obtained from Versa Networks. Licenses are per-tenant and per-feature.
3. Navigate to Administration > System > Settings. Configure: hostname, domain name, NTP servers (critical), SMTP for alerts, and SNMP community strings.
4. Under Administration > Users, create local admin accounts and optionally configure LDAP/RADIUS authentication for centralized identity management.
5. Navigate to Director > Workflows > Tenant and create your first Tenant. In Versa, all SD-WAN configuration is tenant-scoped (multi-tenancy is a core feature). Assign the Analytics controller IP here.
 Pro Tip — Director High Availability
For production deployments, always deploy Director in HA (Active/Standby) mode. Use Administration > System > HA Configuration to add the standby Director node. Both nodes must have identical software versions and reachable management IPs. A floating VIP is used by all VOS nodes to communicate with Director.

② Step 2 — Install Versa Analytics (VAN)

Versa Analytics provides real-time visibility, historical reporting, and AI-driven insights. It must be installed and registered with Director before deploying VOS branch nodes, as analytics registration happens during device onboarding.

1
Deploy Analytics VM — Deploy the VAN OVA/QCOW2 on your hypervisor. Analytics requires more disk than Director due to time-series data storage. For larger deployments (>100 sites), consider a distributed analytics cluster (3-node minimum for HA).
2
Initial Analytics setup — SSH to the Analytics node and configure management IP, hostname, and NTP:
VERSA ANALYTICS — INITIAL SETUP
# SSH to Analytics VM
ssh admin@<analytics-ip>

# Configure network settings
set management ip 192.168.1.11/24
set management gateway 192.168.1.1
set management dns-server 8.8.8.8
set management ntp-server pool.ntp.org
set hostname versa-analytics-01

# Register Analytics with Director
set director ip 192.168.1.10
set director port 7789

# Verify Analytics service status
show analytics status
show analytics cluster-info

commit
3
Register in Director GUI — In Director, go to Administration > Analytics Controller. Add the Analytics node IP address (port 8080). Director will verify connectivity and the Analytics node will appear as "Connected."
4
Configure data retention — In the Analytics GUI (https://<analytics-ip>:8443), set data retention policies for flow records (default: 90 days) and aggregate statistics (default: 1 year). Adjust based on available disk capacity.

③ Step 3 — Deploy Versa FlexVNF / VOS on Branch Devices

The FlexVNF (or VOS node) is the actual SD-WAN device deployed at each site. This step covers both hardware appliance setup and virtual deployment scenarios.

3.1 — Hardware Appliance (Versa CSG Series)

1. Rack & Cable: Mount the CSG appliance, connect power, and connect WAN interfaces (MPLS, broadband, LTE) to the designated WAN ports. Connect LAN interfaces to the branch switch/router.
2. Initial boot & console access: Connect a serial console cable (115200 baud, 8N1). Power on the device. The initial boot will show VOS loading. Default management access: admin / versa123.
3. Zero Touch Provisioning (ZTP): Versa supports ZTP via DHCP option 43 or a staging server. The device queries a ZTP server, downloads its configuration from Director, and self-configures automatically — ideal for large-scale branch rollouts.

3.2 — Manual Initial Device Configuration

VERSA VOS — INITIAL BRANCH NODE SETUP
# Initial login on VOS device console
login: admin
password: versa123

# Enter configuration mode
admin@branch-01> configure

# Set hostname
admin@branch-01# set system host-name branch-site-01

# Configure management interface (for Director reachability)
set interfaces mgmt0 unit 0 family inet address 10.0.1.5/24

# Set default gateway for management
set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 next-hop 10.0.1.1

# Set DNS resolver
set system name-server 8.8.8.8

# Set NTP (critical - must match Director)
set system ntp server pool.ntp.org

# Point device to Versa Director
set system services netconf ssh
set system director ip 192.168.1.10 port 2022

# Set device UUID (from Director device inventory)
set system uuid <device-uuid-from-director>

# Commit and verify
commit
run show system information
run ping 192.168.1.10 count 5

3.3 — Onboard Device in Director GUI

1. In Director GUI, navigate to Workflows > Devices > Add Device. Enter the device hostname, management IP, and select the tenant. Generate and download the serial number / UUID for the device.
2. Select the Hardware Type (CSG1000, CSG5000, or virtual) and the Organization. Assign a Controller Group which determines which Director/Analytics this device reports to.
3. Once the VOS device connects to Director (via NETCONF over SSH on port 2022), Director will push the initial bootstrap configuration automatically. The device status will change from Disconnected → Connected → In Sync.
4. Verify device onboarding: Monitor > Devices — the device should show "In Sync" with a green health indicator.

④ Step 4 — Configure WAN Transport & Underlay Links

WAN transport configuration defines how each physical WAN link (MPLS, broadband, LTE) is presented to the SD-WAN overlay. Each transport link gets a TLOC (Transport Locator) which is the fundamental SD-WAN addressing concept in Versa.

4.1 — Configure WAN Interfaces in Director

VOS — WAN INTERFACE & TRANSPORT CONFIGURATION
# Configure WAN interface 1 (Broadband/Internet)
set interfaces ge-0/0/0 unit 0 family inet address 203.0.113.10/30
set interfaces ge-0/0/0 description "WAN1-Broadband-ISP"

# Configure WAN interface 2 (MPLS)
set interfaces ge-0/0/1 unit 0 family inet address 10.100.1.2/30
set interfaces ge-0/0/1 description "WAN2-MPLS"

# Configure WAN interface 3 (LTE/4G - optional)
set interfaces cellular-0/0/0 unit 0 family inet dhcp
set interfaces cellular-0/0/0 description "WAN3-LTE-Backup"

# Define Transport (TLOC equivalent) for each WAN link
set sd-wan transport WAN1-Internet interface ge-0/0/0
set sd-wan transport WAN1-Internet encap IPsec
set sd-wan transport WAN1-Internet color biz-internet
set sd-wan transport WAN1-Internet bandwidth-up 100
set sd-wan transport WAN1-Internet bandwidth-down 100

set sd-wan transport WAN2-MPLS interface ge-0/0/1
set sd-wan transport WAN2-MPLS encap GRE
set sd-wan transport WAN2-MPLS color mpls
set sd-wan transport WAN2-MPLS bandwidth-up 50
set sd-wan transport WAN2-MPLS bandwidth-down 50

# Default route per transport (NAT for internet, direct for MPLS)
set routing-options static route 0.0.0.0/0 next-hop 203.0.113.9 preference 10
set routing-options static route 0.0.0.0/0 next-hop 10.100.1.1 preference 20

commit
⚠️ Important — Transport Colors in Versa
Versa uses "Transport Colors" to identify and classify WAN links: biz-internet, mpls, lte, public-internet, private1. Colors are referenced in SD-WAN policies to control which transports are used for which traffic types. Consistent color naming across all sites is critical for policy-based routing to work correctly.

4.2 — Configure BFD & Link Health Monitoring

BFD & PATH QUALITY MONITORING
# Configure BFD for fast failure detection
set sd-wan path-quality-profile INTERNET-PROFILE
set sd-wan path-quality-profile INTERNET-PROFILE probe-interval 500
set sd-wan path-quality-profile INTERNET-PROFILE probe-count 3
set sd-wan path-quality-profile INTERNET-PROFILE loss-threshold 5
set sd-wan path-quality-profile INTERNET-PROFILE latency-threshold 150
set sd-wan path-quality-profile INTERNET-PROFILE jitter-threshold 30

# Assign quality profile to transport
set sd-wan transport WAN1-Internet path-quality-profile INTERNET-PROFILE
set sd-wan transport WAN2-MPLS path-quality-profile MPLS-PROFILE

# Verify BFD sessions
run show sd-wan path-quality
run show bfd session summary

⑤ Step 5 — Build SD-WAN Overlay (VPN Tunnels & MPLS-over-IPsec)

The SD-WAN overlay is a logical network built on top of physical WAN transports using IPsec/GRE tunnels. Versa uses a hub-and-spoke or full-mesh overlay model with automatic tunnel formation between all VOS nodes.

5.1 — Create VPN Profiles & Overlay Tunnels in Director

1. Create Provider Organization (PoP): In Director, navigate to Workflows > WAN > SD-WAN Overlay Profile. Define the overlay encapsulation type (IPsec is recommended for internet transports; GRE for MPLS). Set IKE version (IKEv2), encryption (AES-256-GCM), and hashing (SHA-256).
2. Configure Overlay Networks: Navigate to Configuration > Overlay Networks. Create a "Provider Connectivity" overlay. Assign all VOS devices (hub and branches) to this overlay. Versa will automatically compute and establish tunnels between all participating nodes.
3. Define Hub Device Role: In the overlay network configuration, designate data center/hub VOS nodes as "Hub" devices. Branch nodes are designated "Spoke." Hub devices maintain IPsec tunnels with all spokes. In full-mesh mode, spokes also form tunnels with each other.
4. Verify Overlay Tunnel Status: Navigate to Monitor > Paths or run CLI verification commands to check tunnel establishment.
VOS — TUNNEL VERIFICATION COMMANDS
# Show all IPsec tunnels and their states
run show ipsec sa summary

# Show SD-WAN overlay paths (per transport color)
run show sd-wan path summary

# Show path quality metrics (latency, loss, jitter)
run show sd-wan path-quality detail

# Show BGP overlay routing table
run show bgp summary

# Show OSPF adjacency (if using OSPF for LAN redistribution)
run show ospf neighbor

# Show routing table (overlay routes)
run show route table inet.0

# Verify specific tunnel to hub
run show sd-wan connection remote-device HUB-DC-01

⑥ Step 6 — Configure SD-WAN Policies & Application Steering

SD-WAN policies define how traffic is classified, steered, and prioritized across available WAN transports. Versa uses a hierarchical policy model with Application QoS (AppQoS) and Application-Based Routing (AppRoute) policies.

6.1 — Application Identification & Traffic Classification

DIRECTOR — SD-WAN APPLICATION ROUTING POLICY
# Configure in Director GUI:
# Configuration > SD-WAN > App Route Policy

# Example App-Route Policy (CLI reference)
set policy sd-wan-app-route BRANCH-POLICY
set policy sd-wan-app-route BRANCH-POLICY rule VOICE-RULE
set policy sd-wan-app-route BRANCH-POLICY rule VOICE-RULE match application [ ms-teams zoom webex rtp ]
set policy sd-wan-app-route BRANCH-POLICY rule VOICE-RULE action prefer-path mpls
set policy sd-wan-app-route BRANCH-POLICY rule VOICE-RULE action fallback-path biz-internet
set policy sd-wan-app-route BRANCH-POLICY rule VOICE-RULE action sla-profile VOICE-SLA

set policy sd-wan-app-route BRANCH-POLICY rule SAAS-RULE
set policy sd-wan-app-route BRANCH-POLICY rule SAAS-RULE match application [ microsoft-365 salesforce google-workspace ]
set policy sd-wan-app-route BRANCH-POLICY rule SAAS-RULE action prefer-path biz-internet
set policy sd-wan-app-route BRANCH-POLICY rule SAAS-RULE action breakout direct-internet

set policy sd-wan-app-route BRANCH-POLICY rule DEFAULT-RULE
set policy sd-wan-app-route BRANCH-POLICY rule DEFAULT-RULE match application any
set policy sd-wan-app-route BRANCH-POLICY rule DEFAULT-RULE action load-balance [ mpls biz-internet ]

# Define SLA profiles for policy enforcement
set sd-wan sla-profile VOICE-SLA
set sd-wan sla-profile VOICE-SLA latency 150
set sd-wan sla-profile VOICE-SLA jitter 30
set sd-wan sla-profile VOICE-SLA loss 1

commit

6.2 — Common Application Steering Scenarios

Application Type Preferred Transport SLA Requirements Fallback
 Voice & Video (UCaaS) MPLS (primary) Latency <150ms, Jitter <30ms, Loss <1% Internet (if MPLS fails SLA)
☁ SaaS (M365, Salesforce) Internet DIA (direct breakout) Best available path to internet Hub via MPLS
 ERP / Data Center Apps MPLS Latency <300ms, Loss <2% Internet VPN to DC
 Video Surveillance Internet (high BW) High throughput, loss-tolerant LTE
 General Browse / Bulk Load balance all Best effort Any available

⑦ Step 7 — Enable Security Services (NGFW, ZTNA, SWG)

One of Versa's key differentiators is native security integration within the same VOS platform. No separate security appliance is needed — NGFW, ZTNA, URL filtering, and IPS run natively on every VOS node.

 NGFW (Next-Generation Firewall)
Configure zone-based firewall policies in Director under Configuration > Security > Firewall Policy. Versa NGFW supports stateful inspection, application-aware rules, user-identity-based policies (via AD/LDAP integration), and geo-based filtering.
# Firewall zone & policy example (Director CLI reference)
set security zones zone TRUST interfaces ge-0/0/2
set security zones zone UNTRUST interfaces ge-0/0/0
set security zones zone DMZ interfaces ge-0/0/3

set security policies from-zone TRUST to-zone UNTRUST policy ALLOW-OUT
set security policies from-zone TRUST to-zone UNTRUST policy ALLOW-OUT match source-address any
set security policies from-zone TRUST to-zone UNTRUST policy ALLOW-OUT match destination-address any
set security policies from-zone TRUST to-zone UNTRUST policy ALLOW-OUT match application any
set security policies from-zone TRUST to-zone UNTRUST policy ALLOW-OUT then permit

set security policies from-zone UNTRUST to-zone TRUST policy DENY-IN then deny
 ZTNA (Zero Trust Network Access)
Configure ZTNA in Configuration > Security > Zero Trust. Define access policies based on user identity, device posture, and application. ZTNA replaces traditional VPN for remote users with identity-verified, least-privilege application access. Integrates with Okta, Azure AD, and SAML 2.0 IdPs.
 SWG (Secure Web Gateway) & URL Filtering
Enable URL filtering under Configuration > Security > URL Filter. Create URL category-based rules to block malicious sites, control social media access, and enforce acceptable use policies. Versa uses a cloud-based URL categorization database with on-device caching for low-latency lookups. Enable SSL inspection (TLS decryption) for deep inspection of HTTPS traffic.
 IPS / Threat Prevention
Enable IPS under Configuration > Security > IPS Policy. Assign pre-built signature profiles (Critical, High, Medium) to firewall policies. Versa IPS uses Snort-compatible signatures and updates automatically via cloud subscription. Configure inspection modes: Detect (alert only) or Block (prevent and alert).

⑧ Step 8 — QoS, SLA Monitoring & Performance Tuning

 Configure QoS Profiles
Navigate to Configuration > QoS > Profiles in Director. Define traffic queues (Voice, Video, Data, Best-Effort) with DSCP markings, bandwidth guarantees (minimum bandwidth), and priority scheduling (WFQ or CBWFQ). Map DSCP values to queues for end-to-end QoS consistency across MPLS and internet transports.
 SLA Monitoring in Analytics
Access the Analytics dashboard to view per-application SLA compliance, WAN link utilization, and per-path quality metrics (latency, jitter, packet loss). Set SLA thresholds and configure alerting (email/SNMP/webhook) when paths degrade below acceptable levels. Use the "Path Quality History" view to identify recurring transport issues.
 Performance Tuning CLI Commands
# Monitor live traffic flows
run show sd-wan flow active
run show sd-wan statistics summary

# Check WAN link utilization
run show interfaces ge-0/0/0 statistics
run show interfaces ge-0/0/1 statistics

# View real-time path quality
run show sd-wan path-quality transport WAN1-Internet
run show sd-wan path-quality transport WAN2-MPLS

# Check QoS queue statistics
run show class-of-service interface ge-0/0/0 queue

# Application performance summary
run show sd-wan app-route statistics

 Troubleshooting Common Versa SD-WAN Issues

❓ Issue: VOS Device Not Connecting to Director
Causes & Fixes:
• Verify management IP, gateway, and DNS are correctly configured on VOS
• Check firewall rules — port 2022 (NETCONF) must be open from VOS to Director
• Verify time sync (NTP) — certificate validation fails if time drift exceeds 5 minutes
• Run: show system director-connection to see connection state and error messages
• Check Director logs: /var/log/versa/vnms.log for device registration errors
❓ Issue: IPsec Tunnels Not Forming Between Sites
Causes & Fixes:
• Verify NAT traversal is enabled if devices are behind NAT (set ipsec nat-traversal enable)
• Check IKE phase 1/2 proposals match on both ends
• Verify UDP 500 and 4500 are allowed through upstream firewalls
• Run: show ipsec sa detail and show ike sa detail
• Verify transport colors and overlay profile assignments match in Director
❓ Issue: Traffic Not Following SD-WAN Policy (Wrong Path)
Causes & Fixes:
• Verify App-Route policy is committed and deployed to the correct device template
• Check application identification: show sd-wan flow app-info
• Verify SLA profiles are correctly defined and paths are meeting SLA thresholds
• Use policy trace: run test sd-wan policy-route source 10.0.1.1 destination 8.8.8.8 app ms-teams
❓ Issue: Analytics Not Receiving Data from VOS Nodes
Causes & Fixes:
• Verify Analytics IP is correctly configured in Director under Administration > Analytics
• Check port 2050 (NetFlow/IPFIX) is reachable from VOS nodes to Analytics
• Run: show analytics export-status on VOS node
• Check Analytics service status: systemctl status versa-analytics on Analytics VM

⚖️ Versa SD-WAN vs Fortinet SD-WAN — Key Differences

Many enterprises evaluate both Versa Networks and Fortinet (FortiGate SD-WAN) when selecting an SD-WAN platform. Here's a comprehensive comparison to answer the most-asked questions on this topic.

Feature  Versa Networks  Fortinet FortiGate
Architecture Cloud-native, software-first. VOS runs on any x86, VM, or cloud. Truly software-defined. Hardware-centric with FortiGate appliances. SD-WAN is a feature of FortiOS running on FortiGate hardware or VM.
Multi-Tenancy Native multi-tenancy built into Director. Ideal for MSPs and large enterprises with business units. Limited native multi-tenancy. Requires FortiManager ADOM segmentation. Less flexible for MSPs.
SD-WAN Management Versa Director (dedicated SD-WAN + security orchestrator) FortiManager (unified firewall + SD-WAN manager)
Analytics Dedicated Versa Analytics (VAN) — purpose-built big-data analytics platform with AI/ML insights. FortiAnalyzer — Comprehensive logging and reporting, but less specialized for SD-WAN path intelligence.
SASE Integration Native SASE via Versa Titan cloud service. ZTNA, SWG, CASB built into VOS platform. Fortinet Security Fabric (FortiSASE). Strong SASE offering via FortiClient, FortiSASE cloud.
Hardware Ecosystem Versa CSG appliances + whitebox x86 support (open hardware). More flexible hardware choices. FortiGate appliances with NP7/NP8 ASICs for hardware-accelerated performance. Purpose-built silicon advantage.
Market Position Gartner Magic Quadrant Leader (SD-WAN). Strong in large enterprise and MSP segments. Gartner Magic Quadrant Leader (SD-WAN). Dominant in mid-market. Largest installed base globally.
Pricing Model Subscription-based per device/tenant. Often more competitive for large deployments. Hardware + FortiCare support + FortiGuard subscription. Can be more cost-effective for smaller deployments.
 When to Choose Versa vs Fortinet
Choose Versa if: You need true cloud-native SD-WAN, multi-tenant MSP operations, OpenAPI integration, hardware-agnostic deployment, or you're building a greenfield SASE architecture from scratch.
Choose Fortinet if: You already have FortiGate appliances deployed, you need hardware-accelerated performance (NP7 ASIC), you want a tightly integrated security fabric, or you're in the mid-market with budget constraints. Fortinet SD-WAN is included in FortiOS at no extra license cost — a significant advantage.

❓ FAQ — Top Questions from Google & ChatGPT About Versa SD-WAN

Q: What is the default username and password for Versa SD-WAN?
The default CLI credentials for Versa VOS, Director, and Analytics are admin / versa123. You will be forced to change this password on first login. For the GUI, the default is Administrator / versa123. Always change defaults immediately in production. Configure AAA (TACACS+/RADIUS) for centralized authentication in enterprise environments.
Q: What ports does Versa SD-WAN use?
Key ports to allow in your firewall:
• TCP 2022 — NETCONF (VOS to Director)
• TCP 9182 — Director Web GUI (HTTPS)
• TCP 8080 / 8443 — Analytics GUI
• UDP 500 / 4500 — IKE/IPsec (SD-WAN tunnels)
• UDP 4790 — VXLAN (optional overlay)
• TCP 7789 — Analytics ↔ Director communication
• UDP 2050 — NetFlow/IPFIX (VOS to Analytics)
Q: Does Versa SD-WAN support Zero Touch Provisioning (ZTP)?
Yes. Versa supports ZTP via two methods: (1) DHCP Option 43 — the device receives the Director IP and configuration URL from DHCP on first boot, and (2) Versa Cloud Staging — devices call home to a staging server, authenticate using serial number, and download their site-specific configuration from Director. ZTP dramatically reduces on-site technical expertise requirements for branch deployments.
Q: How does Versa SD-WAN handle application identification?
Versa uses a built-in DPI (Deep Packet Inspection) engine called VersaApp that identifies over 3,500+ applications at Layer 7 using signature-based and behavioral detection. It can identify encrypted applications (Microsoft 365, Zoom, Salesforce) by inspecting TLS SNI, certificate fields, and traffic patterns without full decryption. Application signatures are updated via the cloud threat intelligence subscription.
Q: Can Versa SD-WAN run as a virtual machine on VMware or KVM?
Yes. All Versa components (Director, Analytics, and FlexVNF) are available as VM images supporting VMware ESXi (OVA), KVM (QCOW2), Microsoft Hyper-V (VHD), and cloud instances on AWS (AMI), Azure (VHD), and GCP (disk image). This makes Versa ideal for software-defined data centers and cloud-first architectures. For KVM deployments, DPDK (Data Plane Development Kit) can be enabled for high-performance packet processing.
Q: How is Versa SD-WAN licensed?
Versa uses a subscription-based licensing model. Licenses are per-device (VOS node) and per-feature bundle: SD-WAN Base, Security Bundle (NGFW, URL Filtering, IPS, ZTNA), and Analytics. Licenses are applied at the tenant level in Director and pushed to devices. Multi-year term agreements are available. Contact your Versa Networks account team or authorized reseller for pricing — Versa does not publish public pricing.
Q: What is the difference between Versa Director and Versa Analytics?
Director is the configuration and orchestration plane — it provisions devices, pushes policies, manages software upgrades, and is the single pane of glass for operational management. Analytics (VAN) is the data plane for visibility — it collects telemetry from all VOS nodes, stores time-series performance data, provides application-level visibility dashboards, generates compliance reports, and runs AI-driven anomaly detection. They are separate systems that work together — Director tells Analytics which devices exist, and Analytics provides Director with health status for display in the Director dashboard.
Q: How does Versa SD-WAN differ from traditional MPLS WAN?
Traditional MPLS is carrier-managed, expensive, has long provisioning lead times (weeks/months), and lacks built-in application intelligence. Versa SD-WAN creates a software-defined overlay on top of any WAN transport (MPLS, broadband, LTE, 5G), adding: dynamic path selection based on real-time quality metrics, application-aware routing, automatic failover (<1 second), direct cloud/SaaS breakout, and 60-80% cost reduction by replacing expensive MPLS with commodity internet while maintaining or improving SLA performance.

 Summary — 8-Step Versa SD-WAN Setup at a Glance

1 Pre-Deployment Planning — Licensing, hardware selection, IP planning, topology design, and security policy mapping
2 Install Versa Director — Deploy VM, configure management, apply licenses, create tenants
3 Install Versa Analytics — Deploy VAN VM, register with Director, configure data retention
4 Deploy FlexVNF / VOS — Hardware or VM setup, initial CLI config, onboard to Director via ZTP or manual
5 Configure WAN Transports — Define WAN interfaces, transport colors, BFD probes, and link quality profiles
6 Build SD-WAN Overlay — IPsec/GRE tunnels, hub-spoke or mesh topology, BGP overlay routing
7 Configure SD-WAN Policies — App-ID, AppRoute policies, SLA profiles, application steering rules
8 Enable Security & Monitor — NGFW zones, ZTNA, SWG, IPS, QoS profiles, and Analytics dashboards
️ Related Topics & Keywords
Versa SD-WAN setup Versa Networks configuration guide Versa FlexVNF VOS Versa Director installation Versa Analytics VAN SD-WAN IPsec tunnel SD-WAN vs MPLS Fortinet SD-WAN comparison SASE Versa Titan Zero Touch Provisioning SD-WAN Versa CSG1000 CSG5000 SD-WAN application routing policy ZTNA Versa Networks Versa SD-WAN troubleshooting VOS NETCONF configuration
ⓘ This article is provided for educational and technical reference purposes. Always refer to the official Versa Networks documentation at docs.versa-networks.com for the most current CLI syntax and GUI procedures. Configuration commands may vary between VOS software versions. Test all configurations in a lab environment before production deployment.