T Techclick ← All lessons
Versa · Secure SD-WAN · Interactive lesson

Four planes, one staging join — Versa SD-WAN

The CSG is powered. DHCP on WAN is green. Director still shows Shipped. This page is the Versa model: Director, Controller, Analytics, VOS — then the staging tunnel that must succeed before any branch-to-branch overlay exists.

18 min read · L2 primary · Quiz at end

After this page you can

1. Why this overlay exists

Ticket: Pune CSG300 cannot reach SAP in Mumbai. Internet ping works. Director inventory still says Shipped. No branch-to-branch IPsec SA.

Legacy WAN backhauled SaaS through the data-center firewall. Versa’s answer is one VOS image that can be a branch CPE, a Controller, or a Gateway — plus a Director that pushes templates, and Analytics that watches SLA and security events.

Old lab name you will still hear: FlexVNF. Current name: VOS (Versa Operating System) on a CSG appliance or a white-box x86.

Hero · underlay plus overlay
Branch WAN rack with MPLS and Internet circuits rising to four control nodes
Notice: two underlay circuits. Only VOS forwards user packets. Director never sits in the data path.
Quick answer

Director manages. Controller is the IKE + MP-BGP attachment point. Analytics watches. VOS forwards and runs security. Staging builds a limited-privilege tunnel first. Then production IKE to both Controllers, BGP route-reflector updates, and branch-to-branch IPsec without an N² IKE mesh.

2. Four planes — plus what sits above them

Versa marketing now says SASE. The four building blocks did not change. Interviews still fail when students put Analytics in the data path or call Director “the brain.”

Feel · four stacked jobs
Four stacked glass platforms: Direct, Control, Analyze, Forward
Director writes. Controller reflects. Analytics observes. VOS forwards. Concerto is a workflow layer on top, not a fifth plane.
PlaneComponentWhat it actually does
ManagementVersa DirectorSingle pane: Workflows, templates, inventory, NETCONF-over-SSH config push, monitoring. Device templates here are also called post-staging templates.
ControlVersa ControllerSame VOS software, different role. Authenticates the branch with PKI/IKE, holds the secure control channel, acts as a multi-instance MP-BGP route reflector, and distributes SAs so branches do not run a full IKE mesh.
AnalyticsVersa AnalyticsNear-real-time big data: usage, SLA, security events, reports. Fed by VOS. Not a forwarder.
DataVOS on CSG / x86 / GatewayIPsec overlay, VRFs (org services), NGFW/UTM, AppQoS, DIA NAT, SLA probes (Y.1731-style). This is the only box in the user path.
Figure 1 · Versa four planes
Management Director Workflows · templates NETCONF over SSH Control Controller IKE + MP-BGP RR Distributes SAs Analytics Analytics SLA · security · reports Not in data path Data VOS / CSG was FlexVNF IPsec + NGFW Not a fifth plane — sits above Concerto SASE / multi-Director orchestration workflows on top of Director stack Titan SMB web + mobile activate / Wi-Fi / LTE Staging server Optional first hop serial + 2FA claim then your Controller

Source: Versa product components + SD-WAN Solution Architecture. Controller software is VOS too.

Say this out loud

Director is the operations office. Controller is air-traffic control. Analytics is the scoreboard. VOS is the aircraft. If Director is down, planes already in the air keep flying until Controller hold timers expire.

Org / tenant / VRF

Versa is multi-tenant. One VOS instance can serve many tenants (docs: up to 256 on a Controller). Each tenant has its own MP-BGP session and overlay.

Control VR

The Control virtual router holds the BGP sessions to the Controller. Do not confuse it with the LAN VRF that users sit in.

Same VOS, three jobs

Branch CPE, Controller, and SD-WAN Gateway share one binary. Role is how you deploy it, not a different OS.

Versus Viptela

No vBond equivalent as a permanent plane. Staging server is optional. Control protocol is IKE + MP-BGP, not OMP.

3. Staging to post-staging

Official onboard has three stages: pre-attach the VPN, pre-attach the VOS, attach the VOS. Global ZTP adds a Versa cloud prestaging hop before your Controller.

The staging tunnel is limited-privilege. It exists so Director can push the real template over NETCONF-over-SSH. Then the branch builds production IKEv2 to both Controllers and holds BGP to both.

Journey · four join beats
Four glass panels: call home, stage, authenticate, go live
Call-home or staging.py → staging Controller → claim / 2FA → production IKE + BGP.
Figure 2 · VOS attach sequence
1. WAN + DHCP or staging.py static 2. Staging IKE PKI / Versa-signed cert 3. Claim + 2FA serial on inventory 4. Post-staging VPN CA · IKE both Ctrls · BGP · NETCONF 5. Controller reflects MP-BGP NLRI + inbound SA → branch-to-branch IPsec (no N² IKE) SLA probes start if policy-based forwarding / AppQoS is in the post-staging template Healthy after attach • Staging tunnel gone or unused • IPsec SA to both Controllers UP • BGP to both Controllers • Branch-to-branch SA appears • Director Tasks = Deployed Stalled Serial not in inventory / not claimed Sits in Shipped forever -l / -r ID mismatch on staging.py IKE_AUTH fail = cert / clock No post-staging template attached

Sources: Versa SD-WAN Solution Architecture (pre-attach / attach) and Activate VOS Devices (Global ZTP three steps).

Pre-train these words

Staging vs post-staging — staging is the limited tunnel to get config. Post-staging is production IKE + BGP + services from the device template.

MP-BGP on the Controller — route reflector per tenant. Carries prefixes, labels, and inbound IPsec SA so branches can build data tunnels without IKE to every peer.

Graceful restart — default on Controller; keeps MP-BGP routes about 8 hours (multiplier 8) so a Controller outage does not immediately drop CPE-to-CPE overlays.

Control channel — IKE between branch and Controller. Director and Analytics ride that secure path. Dead-peer detection, BGP hold, and BFD detect loss.

4. How to choose the onboard method

All four methods end at a staging Controller. They differ in how the box learns that Controller.

MethodUse whenFirst contactDo not mix
Global ZTPFactory CSG, DHCP WAN, serial already given to VersaCall-home to Versa cloud staging, then your ControllerUsing a VOS train that is EOS/EOL — Global ZTP is not supported on retired trains
URL-based ZTPOnsite person has the email link; chassis can change (RMA)Laptop on LAN (docs: port 2 / 192.168.1.1) or Wi-Fi; click URLNon-factory config — amber light; run request system load-default
CLI staging.pyNAT blocks call-home, lab, brownfieldsudo /opt/versa/scripts/staging.py -l … -r … -c …Swapping local-id and remote-id (-l/-r)
USBPhysical access; no laptop workflowRoot of stick: staging.params (Release 21.2+)Putting the file in a subdirectory

Director template names you will see for Global ZTP: Versa Prestaging, Versa Staging, Versa Staging FQDN, Versa Dummy Post-Staging. Device groups match: Prestaging DG, Staging DG, Staging FQDN DG.

5. Runbook — Side A / B / C

Dummy lab on this page: org Techclick-Lab, Controller 203.0.113.10, local-id pune-br1@techclick-lab.com, remote-id controller-staging@techclick-lab.com. Confirm live IDs on your Director before you type them.

Side A — VOS / CSG

Source: Activate VOS Devices — CLI staging script and factory reset.

  1. Confirm WAN and factory state

    VOS CLI · dummy lab
    show interfaces brief
# URL ZTP needs factory default. Amber Web-UI light?
request system load-default

  2. If ZTP cannot call home, run staging.py

    PDF + official docs: ID mismatch on -l / -r is the most common field failure.

    Example from Versa Activate docs (IDs changed to dummy)
    sudo /opt/versa/scripts/staging.py \
  -l pune-br1@techclick-lab.com \
  -r controller-staging@techclick-lab.com \
  -c 203.0.113.10 \
  -w 0 -d

  3. Need static WAN instead of DHCP

    Add -s prefix/mask and -g gateway. Use -h on the script for the full flag list (PSK, cert, PPPoE, LTE, VLAN).

Common lab mistake

-l is the branch identity. -r is the Controller staging identity. Swap them and IKE never completes. The box does not always scream — it just sits.

Side B — Director

Source: Activate VOS Devices + Director GUI Overview. Paths below are documented top-bar / left-nav names.

https://director.lab.example.com — Workflows → Devices → Add Device
Training mock · not live

Workflows → Devices → Basic

Add Device · pune-br1

FieldDummy lab
Namepune-br1
Serial / chassis IDCSG300-9AB12C
OrganizationTechclick-Lab
Device groupVersa Staging DG
Staging ControllerSDWAN-Controller1

Global ZTP needs that serial on Versa’s prestaging inventory and on this Director. Missing either side = Shipped forever.

  1. Put the chassis on inventory

    Administration → Inventory → Hardware. Add serial. For URL ZTP, set URL-Based ZTP, staging Controller, and VPN profile of type controller-staging-sdwan.

  2. Workflows → Devices → Add Device

    Basic tab: name, org, serial as chassis ID, device group. Bind Data / post-staging template, then Deploy. Watch Tasks.

  3. Attach a post-staging (device) template

    Configuration → Templates → Device Templates. Staging templates only redirect. Services live on the post-staging template: VRFs, BGP to Controller, AppQoS, DIA NAT.

https://director.lab.example.com — Administration → Appliances
Training mock · not live

Administration → Appliances

Org Techclick-Lab

ApplianceRoleSyncReachability
pune-br1BranchIn SyncReachable
lab-spareBranchShippedUnknown
SDWAN-Controller1ControllerIn SyncReachable

Healthy branch: Reachable + In Sync. Shipped means staging never finished or serial was never claimed.

Side C — Prove

Source: Techclick Versa fundamentals PDF (IPsec SA uptime) + Solution Architecture (IKE + MP-BGP).

  1. IPsec SA table

    First rows should be branch-to-Controller. Status UP and uptime climbing is the key health indicator from the class PDF.

    Concept — confirm exact show path on your VOS train
    show orgs org-services Techclick-Lab ipsec
# Monitor path on Director: Sessions / IPsec / IKE Security Association

  2. BGP to both Controllers

    Production design holds an IKEv2 tunnel and a BGP session to each Controller. One Controller is not HA.

  3. Director Tasks + Appliances

    Deployed / In Sync. Then look for a branch-to-branch SA after the Controller has reflected the inbound SA.

6. After join — control vs data

Staging success is control-plane success. Users still fail if SLA or security policy drops the app. Separate the tickets.

Figure 3 · runtime path after a healthy attach
Pune VOS branch CPE Controller BGP Director NETCONF Mumbai VOS branch CPE CONTROL · IKE + MP-BGP · orange DATA · IPsec from reflected SA · no IKE mesh If users are down, ask which plane first Shipped / no Controller SA → staging, serial, -l/-r, cert Controller up, no branch SA → topology / RR policy, not ZTP

User packets do not hairpin through Director. After attach they do not hairpin through Controller either — Controller only reflected the SA.

If the Controller dies

Docs: full loss of all Controllers makes IKE DPD / BGP / BFD declare control down and can tear CPE-to-CPE overlays. Mitigate with two Controllers and graceful restart (default ~8 hours). PDF: Director failure does not take the Controller down with it.

7. Traps and proof

Ops · prove it, then close the ticket
Operations desk with a monitor showing green health checkmarks
Green WAN DHCP is not proof. IPsec SA UP + BGP + Director In Sync is proof.
SymptomFirst meaningFirst fix
Inventory stays ShippedSerial never claimed, or staging IKE never finished.Match chassis on Administration → Inventory → Hardware and Workflows → Devices. Claim / 2FA if prompted.
-l / -r mismatchMost common CLI staging failure (class PDF).Local-id = this branch. Remote-id = Controller staging identity. Re-run staging.py.
IKE_AUTH failureCertificate / TPM / clock / expired Versa-signed cert.Check clock. Confirm TPM cert still valid. Replace with VPN CA after pre-attach.
URL ZTP amber lightNot factory default.request system load-default then click Start Activation again.
No VPN profile in URL ZTP listController not marked staging, or no controller-staging-sdwan profile.Director CLI: staging-controller true on that appliance; show … ipsec vpn-profile vpn-type controller-staging-sdwan.
Director down, users still upExpected. Director is management.Do not rebuild tunnels. Restore Director. Overlay holds via Controller + GR.
Both Controllers gone past GRControl plane declared dead; data overlays can drop.This is why you deploy two Controllers. Restore one before the 8-hour retain expires.
Pilot checklist
Interview trap

Students say “Director is the brain, like vSmart.” No. Controller is the brain. Director is the pane of glass. Analytics is the historian. If you say Director reflects routes, you fail the oral.

Knowledge check

Six judgment items. Same ticket: CSG up, inventory Shipped, no overlay.

Q1

A branch needs its post-staging template. Which plane pushes that config?

Correct: b. Re-read Four planes. Director manages. Controller only carries the secure path.
Q2

What protocol pair is the Versa control plane between branch and Controller?

Correct: a. Re-read Four planes / After join. Versa does not use OMP.
Q3

Director VM is down. Both Controllers are up. Branch-to-branch SAs were already built. What should you expect?

Correct: c. Re-read Traps. Director failure is not Controller failure.
Q4

CLI staging never completes. The engineer used -l controller-staging@… and -r pune-br1@…. First fix?

Correct: b. Re-read Runbook Side A. ID mismatch is the classic staging stall.
Q5

Why can two Versa branches build an IPsec data tunnel without an IKE session to each other?

Correct: d. Re-read Staging flow and After join. This is the scale trick.
Q6

A student says Analytics must be in the forwarding path because it “sees every flow.” What is the strong answer?

Correct: c. Re-read Four planes. Analytics is a plane. It is not in the data path.

Sources

Related: Cisco Viptela four planes · Older Versa architecture page · Older ZTP page · Controller deep-dive · Director orchestration

This lesson is the gold four-plane + staging map. Use the older Versa series pages for extra drills.