Most engineers think…
Most people picture SD-WAN segmentation as 'a few VLANs and an ACL on the branch'. That mental model collapses the moment an interviewer asks how Versa serves dozens of customers on shared boxes, or how PCI traffic stays isolated all the way across the WAN.
Versa separates traffic at two distinct levels. Tenants are organizations in Director — each gets fully isolated config, policy, RBAC and analytics, and a provider org can contain sub-organizations. Segments are VRFs on the branch — Corp, Guest, PCI, IoT, OT — and the isolation rides the overlay end-to-end, not just locally. Knowing which level solves which problem is the whole interview.
① Two levels of separation — tenants and segments
The single idea to anchor on: Versa separates traffic twice. The outer level is the tenant — an organization in Director that gives a customer or business unit full administrative isolation. The inner level is the network segment — a VRF on the branch that keeps Corp, Guest, PCI, IoT and OT traffic apart.
This matters because the two levels solve different problems. Tenants answer 'how does one platform serve many customers or business units with separate admins and separate dashboards?' Segments answer 'how does PCI traffic stay isolated from Guest traffic — locally and all the way across the WAN?'
Versa carries the heritage of service-provider / managed SD-WAN, so it was multi-tenant from the start rather than bolting it on later. That is why both levels feel native instead of like an afterthought.
Versa separates traffic at how many levels, and which?
② Tenants in Director — organizations, sub-orgs and RBAC
A tenant in Versa is an organization hosted in Director. Each organization has its own isolated configuration, policy set, RBAC and analytics, so one platform can serve many customers or many internal business units without leaking between them.
The provider / sub-organization model
A provider organization can contain sub-organizations. This is the classic multi-tenancy shape an MSP uses — the provider manages the estate while each customer sub-org sees only its own config, policy and reports. An enterprise uses the same shape to split finance, retail and corporate IT into separate administrative tenants.
The interview phrasing: tenants are administrative isolation. Different admins, different dashboards, different policy trees — one Director, many organizations.
A customer or business unit in Director with fully isolated config, policy, RBAC and analytics. One platform, many organizations.
A tenant nested under a provider organization — the MSP shape where each customer sees only its own config and reports.
A routing instance on the branch — Corp, Guest, PCI, IoT, OT — with its own routing table, isolated from other segments.
The SD-WAN tunnels tag traffic so each segment and tenant stays separate across shared transport — isolation end-to-end.
In an interview, lead with the two-level model: tenants (organizations in Director — administrative isolation for MSP / multi-BU) and segments (VRFs carried end-to-end across the overlay, each with its own routing and security policy). Naming both levels and what each solves is the answer interviewers want.
What does an organization (tenant) in Versa Director isolate?
③ Segments as VRFs — isolation carried end-to-end
Inside a tenant, you carve traffic into network segments, each implemented as a VRF / routing instance. A segment such as Corp, Guest, PCI, IoT or OT gets its own routing table and is isolated from the others — addresses in one segment cannot reach another unless you deliberately leak routes.
End-to-end, not just local
The key Versa point: that isolation is carried end-to-end across the SD-WAN overlay. On the LAN side, user VLANs and subnets map into segments. On the transport side, the segment-aware overlay tags traffic so segments ride the shared tunnels without mixing.
So PCI on Branch A reaches PCI on Branch B over the overlay, but never touches the Guest segment in between. That is end-to-end isolation — and it is what a VLAN-and-ACL answer misses.
A VLAN and an ACL only isolate traffic on the local switch. Versa segments are VRFs whose isolation is carried end-to-end by the segment-aware overlay, so PCI on one branch reaches PCI on another without ever touching Guest in transit. Always say 'end-to-end', not 'local'.
▶ Watch PCI traffic cross the WAN without touching Guest
How one segment stays isolated end-to-end across the overlay. Press Play for the healthy path, then Break it to see the classic failure.
A network segment on a Versa branch is implemented as…
④ Per-segment policy and the real-world use cases
Segmentation is only half the value — the other half is per-segment policy. Each segment can have its own SD-WAN steering and its own security policy. PCI is locked down with strict firewall and inspection; Guest gets Internet-only breakout and never sees corporate routes; IoT/OT is tightly fenced; Corp gets full app-aware steering.
Where this earns its keep
The headline use cases: an MSP serving many customers on shared infrastructure (tenants do the heavy lifting); an enterprise isolating PCI/finance, guest Wi-Fi and IoT/OT (segments do the heavy lifting); and merging networks after an M&A without IP-overlap headaches, because separate VRFs can carry overlapping address space.
The clean interview close: two levels — tenants for administrative isolation (MSP / multi-BU) and segments (VRFs carried end-to-end, each with its own routing and security policy). That is why Versa is strong for service providers and regulated networks.
Priya at a Pune retail chain faces this
After acquiring a smaller chain, both networks use 10.10.0.0/16 and the new stores cannot be onboarded — addresses overlap and routes clash.
The teams tried to merge everything into one flat routing table, so the duplicate 10.10.0.0/16 ranges collide.
Check Director — both the existing and acquired sites are mapped into the same segment/VRF, so the overlapping subnets fight for the same routes.
Director ▸ Organization ▸ Network Segments (VRFs) ▸ LAN-to-segment mappingPlace the acquired sites in a separate network segment (VRF). Each VRF carries its own routing table, so the overlapping 10.10.0.0/16 ranges coexist; leak only the specific routes both sides genuinely need.
Onboard a new store: it joins its own segment, the overlap no longer clashes, and inter-segment reachability is limited to the explicitly leaked routes.
Don't claim two segments are isolated — show it. Each VRF has its own routing table in Director; confirm the Guest VRF has no corporate routes and PCI has no path to Guest. The per-segment routing view answers most isolation questions without guessing.
You must give guest Wi-Fi Internet access but no path to corporate apps. Best Versa approach?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does Versa separate traffic at two levels instead of one? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Organization (tenant)
- A customer or business unit hosted in Versa Director with its own isolated config, policy, RBAC and analytics — the outer level of separation.
- Sub-organization
- A tenant nested under a provider organization, seeing only its own config and reports — the shape an MSP uses to manage many customers.
- Multi-tenancy
- One shared platform hosting many logically isolated tenants at once; native to Versa thanks to its service-provider heritage.
- Network segment
- A traffic zone such as Corp, Guest, PCI, IoT or OT, implemented as a VRF and isolated from the other segments.
- VRF / routing instance
- Virtual Routing and Forwarding — a separate routing table per segment, so overlapping or isolated address spaces coexist cleanly.
- Segment-aware overlay
- SD-WAN tunnels that tag traffic per segment so each segment and tenant stays separate while sharing the same transport.
- End-to-end isolation
- Separation between segments that holds across every WAN hop, not just on the local switch — what a VLAN-and-ACL answer misses.
- RBAC
- Role-Based Access Control — admins only see and edit the tenants and functions assigned to their role, keeping tenants apart.
- Versa Director
- The management and orchestration plane that hosts every tenant, pushes config and policy, and shows per-tenant analytics.
📚 Sources
- Versa Networks — Versa SASE / Secure SD-WAN product pages and multi-tenancy overview. versa-networks.com
- Versa Networks — Versa Director: organizations, sub-organizations and RBAC. docs.versa-networks.com
- Versa Networks — Network segmentation with VRFs / routing instances on Versa Operating System (VOS). docs.versa-networks.com
- Versa Networks — Segment-aware SD-WAN overlay and LAN-to-segment mapping. docs.versa-networks.com
- Versa Networks — Per-segment security policy and Internet breakout (guest, PCI, IoT/OT). versa-networks.com
- Versa Networks — Managed SD-WAN for service providers (MSP multi-tenant deployments). versa-networks.com
What's next?
Got tenants and segments? Next, go deep on Versa security services per segment — the firewall, IPS, URL filtering and SASE/SSE breakout that ride each VRF, and how policy follows the user no matter which segment they sit in.