Versa Secure SD-WAN — Director, Overlay & SASE Track

• Why enterprises left MPLS-only WAN — cost, cloud breakout, provisioning time
• Underlay vs overlay: the mental model everything else depends on
• SD-WAN vs SASE vs SSE — what each term actually delivers
• Versa positioning against Cisco Catalyst SD-WAN, Fortinet, Prisma SD-WAN and VeloCloud
• Single-stack VOS: routing, security and SD-WAN in one software image

• Headend vs branch (edge) node split
• Versa Director — service creation, configuration and policy management plane
• Versa Controller — control plane, IKE + PKI branch authentication, Netconf-over-SSH push
• Versa Analytics — log collection, reporting, historical search and alerting
• VOS / FlexVNF — the multi-tenant network + security software stack at the edge
• Versa Concerto — microservices orchestrator for Secure SD-WAN and SASE tenants
• Where Titan (cloud-managed) fits versus a self-managed Director headend

• On-prem, cloud-hosted and provider-managed headend topologies
• Sizing Director, Controller and Analytics for branch count
• Controller placement, redundancy and regional design
• Northbound / southbound interfaces and required firewall openings
• Certificate hierarchy and PKI planning before day one

• ZTP flow end to end — staging, activation, controller registration
• Serial number / token based activation and two-factor branch authentication
• Staging vs post-staging configuration
• What actually goes wrong: DHCP on WAN, NTP skew, DNS, certificate mismatch
• Lab: onboard a branch from factory state to fully steered traffic

• Organizations, tenants and appliance ownership model
• Device templates vs service templates — what belongs where
• Device groups, bind data and variable-driven branch rollout
• Workflows for repeatable site builds at scale
• Commit templates, config diff and rollback discipline

• WAN interface types — broadband, MPLS, LTE/5G; transport domains
• Networks, VRFs and routing instances in VOS
• Static routing, BGP and OSPF on the LAN and WAN side
• NAT, DHCP and interface-level services
• Route redistribution between underlay and overlay — where loops get created

• SD-WAN overlay tunnel establishment and IPsec protection
• Control-plane route exchange between branches and Controller
• Hub-and-spoke, partial mesh, full mesh and dynamic branch-to-branch
• Path selection primitives — circuits, paths, path MTU
• Verifying the overlay: adjacency, tunnel state and reachability checks

• SLA profiles — latency, jitter, loss thresholds and probe behaviour
• SD-WAN policies and rules: match on app, user, source, DSCP
• Forwarding profiles, circuit priority and load balancing
• Forward Error Correction and packet replication for voice and video
• Application identification and direct internet breakout for SaaS
• Lab: brown-out a circuit and prove the steering decision in Analytics

• Tenant and sub-tenant separation on shared infrastructure
• LAN segmentation with VRFs and inter-segment leaking rules
• Guest, IoT, OT and corporate segment design patterns
• QoS classification, marking, queuing and shaping per transport
• Bandwidth policy on constrained branch links

• Stateful firewall and NGFW policy structure inside VOS
• IPS / IDS profiles and signature management
• URL filtering, web categories and reputation
• Anti-virus, anti-malware and file filtering
• SSL decryption — where to enable it, and what it will break
• DoS protection and CGNAT considerations at the branch

• Versa SASE gateway model and cloud service points
• Versa Secure Access for remote and work-from-anywhere users
• ZTNA application access versus full-tunnel remote access
• Identity integration and posture-aware policy
• SASE tenant configuration from Concerto
• Design comparison with Zscaler ZIA/ZPA and Prisma Access

• Log export from VOS to Analytics; collectors and drivers
• Dashboards for SD-WAN, application and security events
• Historical search, custom reports and scheduled delivery
• Alarms, alerts and notification integration
• Forwarding events to an external SIEM such as Microsoft Sentinel or Splunk

• Branch HA pairs, redundancy modes and failover behaviour
• Headend redundancy and Director HA
• Software upgrade strategy, staging and rollback windows
• Backup, restore and disaster-recovery drill
• Structured troubleshooting: control plane → overlay → policy → security → capture
• Common production faults — tunnel flap, SLA thrash, template push failure, log gap

• VNX100 — Versa Certified SD-WAN Associate blueprint walkthrough
• VNX301 — Versa Certified SD-WAN Specialist scope
• VNX326 (Security Specialist), VNX400 (SD-WAN Professional), VNX125 (SSE Associate) overview
• Mock exams and question patterns
• L1 / L2 / L3 SD-WAN interview question bank
• Portfolio artifact: a documented branch design with evidence

Director is the management and service-creation plane — templates, workflows, policy, config push. Controller is the control plane — it authenticates branches with IKE and PKI, distributes reachability, and relays configuration to the edge. Analytics is the data plane's memory — logs, reports, historical search and alerting. VOS at the branch is where routing, SD-WAN and security actually execute. Candidates who blur Director and Controller lose the room immediately.

In order: WAN interface has an address and default route → DNS resolves the Controller/Director FQDN → NTP is sane (certificate validation fails on clock skew) → the device's serial or activation token matches what is staged in Director → the certificate chain and two-factor branch authentication complete → only then look at the control connection and tunnel state. Most real ZTP failures die at DNS, NTP or a staging mismatch, not at the tunnel.

Two layers. An SLA profile continuously probes each path for latency, jitter and loss. An SD-WAN policy rule matches the traffic — by application, user, source or DSCP — and points at a forwarding profile that lists candidate circuits and the SLA it must meet. The rule picks a member currently inside SLA; if none qualifies, the configured priority or load-balancing behaviour applies. Naming the two layers separately is what separates a real answer from a memorised one.

Underlay is the transport you buy: broadband, MPLS, LTE, plus the routing that reaches the next hop. Overlay is the encrypted SD-WAN fabric built on top, with its own route exchange. It matters because the two failure modes look identical from a user's desk and are fixed in completely different places — an underlay problem is an ISP or routing ticket, an overlay problem is a tunnel, certificate or policy issue. Diagnosing the wrong layer is the most common time-waster in SD-WAN operations.

Device templates carry what is tied to the appliance and its site — interfaces, transports, addressing, site variables. Service templates carry the shared service definitions that many sites reuse — security profiles, SD-WAN policies, QoS. Get this split wrong and every branch becomes a snowflake, which is exactly the problem SD-WAN was bought to eliminate.

When the branch appliance is already CPU-constrained, when regulatory or privacy policy excludes categories such as banking and healthcare, and for applications that pin certificates or enforce HSTS in a way decryption will break. The practical answer is a selective decryption policy with a documented bypass list — not a blanket on or off.

No. Solid networking fundamentals plus BGP or OSPF at CCNA level is enough. Module 1 builds the underlay/overlay model from scratch before any Versa screen appears.

₹25,000 for the full 14-module track, live plus recordings. A partial-access option is available if you want the workbook and prerequisite material first and want to upgrade later. WhatsApp us for the current batch date.

Yes — guided lab walkthroughs covering branch onboarding, template push, SLA-based steering, segmentation and security policy. Versa is licensed software, so lab format depends on the environment available for your batch; confirm the current arrangement before you enrol.

No. VNX exams are booked directly with Versa Academy at their own cost. This course prepares you for the VNX100 and VNX301 blueprints; it does not bundle or proctor the exam.

About 40 hours across 16 live classes, two per week, over roughly 8 weeks. WhatsApp us for the next start date.

We provide CV review and interview preparation, not direct placement.