Unleash the Full Power of SASE-on-SIMVersa SASE For Packet Core NetworkWhite Paper

Table of Content
WHAT IS SASE-ON-SIM AND WHY IS IT IMPORTANT ? ........................................................................................... 3
SERVICE PROVIDER USE CASE SCENARIOS .............................................................................................................. 4
VERSA SASE-ON-SIM FOR PERIMETER-LESS PRIVATE MOBILE NETWORK ............................................................... 4
ARCHITECTURE AND TRAFFIC FLOWS .......................................................................................................................................5
VERSA SASE BENEFITS ............................................................................................................................................ 6
WHY VERSA NETWORKS? ...................................................................................................................................... 82Copyright © 2023 Versa Inc.

What is SASE-on-SIM and why is it important?
In today's rapidly evolving business landscape, enterprise mobility has become an indispensable
tool for organizations to stay competitive and efficient. With the rise of private mobility, whichrefers to mobility solutions that are made available to the enterprises, organizations are finding
new ways to enhance their operations and achieve better outcomes. This white paper explains
how Versa SASE with various technologies provides such a foundation for Private mobility use
case scenarios.
However, Service Providers have faced several challenges to deliver private mobility with optimaluser experience and data privacy to enterprises, when using traditional solutions for IoT andMobility projects.

A few key challenges are the following:---

Dependency on software clients to effectively access internal applications when outside theenterprise premises. This leads to inconsistent application and security experience and added
operational complexity for IT to manage the lifecycle of software clients
Most IOT devices are closed box systems which do not allow the installation of additional
software clients and agents. This leads to potential gaps in security landscape which could beexploited by threat actors.
Legacy VPN concentrator technologies cannot provide effective segmentation and gives
wholesale access to the entire network which increases overall risk to the organization.
Enterprise IT teams do not have visibility of network activity when devices are outside
enterprise network and are not connected to the VPN.
Segregated security solution with perimeter-based security. People tend to compare theperimeter-based security with ZTNA. The latter has attracted a lot of the industrial interests
as it was released, reason is simple and as its name indicated, Trust no one until policypermits.
3Copyright © 2023 Versa Inc.Service Provider Use Case Scenarios
For Service Providers, Private mobility delivers low latency distributed security edges for retailuse cases at a fraction of the cost. Some key use case scenarios where service providers candeliver contextual, risk based security with optimal user experience are:Industry

Use Case Scenarios

Smart Cities, Government,
Municipalities

Cameras, Sensors, Smart Billboards, Water meters, GasMeters(Multi-tenancy, AI/ML Data Analytics, Traffic Steering)

Retail Industry

Scanners, IoT, Robots delivery(Obfuscation, Clientless SASE, Traffic Pattern Analysis)

Energy Sectors, Utilities

Autonomous Vehicles, Drones(Traffic Steering and Optimization)

Public Safety

Body Cams, Push-to-Talk(Real-Time Traffic Optimization, MOS-Based TrafficSteering)

For such Industry 4.0 use cases there is a need to introduce security at cloud scale, but at thesame time ensure meeting aggressive SLA's through edge computing. For Service Providers it isimperative to make sure that that attack surface is protected, as proliferation of users and IoT
devices are all an expanded attack surface.
Thus the entire SP mobility ecosystem needs to be secured with zero trust, where nothing istrusted by default. Versa SASE delivers the required mechanism for holistic Zero trust.

Versa SASE-on-SIM for Perimeter-less Private Mobile Network
Versa SASE allows organizations, especially for those who consume SASE-on-SIM (Privatemobility) services to deploy SASE in the most flexible manner. Integration can be implemented
4Copyright © 2023 Versa Inc.

between light cloud to heavy cloud, to light branch, or to heavy branch deployment options,
including in packet core networks.
The below diagram illustrates a classical use case where Versa SASE Gateway naturally fits intoa packet core network performing network segmentation and traffic inspection.
When Versa SASE Gateways are introduced into the network, additional layers of intelligences
along with benefits are made available to the enterprises, such as:••••

SD-WAN Awareness - perfect for inter-branch communications.
Built-in Security – Selectively enable NGFW, URL Filtering, UTM functions
Traffic Steering – Break out traffic to Internet Locally, Remote Breakout at Hub/DC
SaaS intelligence – SaaS Monitoring and Optimization

Figure – Modernized Packet Core Network with Versa SASE Gateway

Architecture and traffic flows
Requiring minimal to no infrastructure change, the Versa solution can seamlessly fit into Mobile
Network Operator (MNO)’s existing networks by adding a “SASE” domain. From Control-planeperspective, MNO Operation team will benefit from Versa fully opened RESTful API to auto
provision new endpoints via IMEI/IMSI, such information will be populated across Versa
gateways in the SASE domain.
5Copyright © 2023 Versa Inc.

From data-plane perspective, Versa SASE Gateway segregates the traffic to specific tenant
based on the IP address and device information (i.e., IMSI/IMEI). All traffic destined toenterprise network is sent to Enterprise private network over secure tunnel (SD-WAN or IPsec).
Any traffic going to internet could be NAT’ed before sending packets to the Internet. All traffic
can be securely inspected as per policy configuration.

Versa SASE Benefits
In general, Versa SASE enables organizations to securely connect Devices (IoT, UE’s, Sensors,etc.) to branch offices, users, applications, and devices regardless of their location. SASE include
many networking and network security services, and several capabilities found in SASE, such as
SD-WAN and SWG, have been leveraged by organizations as industry best practices for severalyears. SASE transforms the traditional networking model of networking and security capabilities
being service chained together. SASE enables organizations to adopt an architecture thatconnect, secure, and monitor applications and users where they exist.
Key Versa SASE services available via the cloud, on-premises, or as a blended combination ofboth include, but are not limited to:

6Copyright © 2023 Versa Inc.

Minimal to No Infrastructure change
Versa Solution can be easily deployed with minimal and even no change to be made within
MNO’s existing mission critical infrastructure, the new “SASE domain” is only added as anextension to the existing MNO network. This greatly increases “time-to-market” efficiency, andharmless to network uptime commitment.
Securely bridging “Shared” and “Private” infrastructure
Versa Solution acts as the “glue” between the “shared” endpoint infrastructure on the left and“private” enterprise infrastructure on the right. The unified SASE infrastructure with genuine
multi-tenancy minimizes the need of repetitive deployment for each new customer, while many
value-added services mentioned previously (SD-WAN Aware, Built-in Security, etc.) are beingoffered.
Clientless SASE
Many types of clients in SASE-on-SIM deployment are unintelligent, such as cameras, sensors,
thin clients. As these endpoints attach to field radio network, Versa SASE Gateways utilize theIMSI/IMEI along with IP address information shared by mobile operators for tenant’s traffic
identification, endpoints are now mapped to the correct network segment, and ready forfurther processing.
SD-WAN AwarenessVersa SASE Gateways are part of Versa ecosystem, and therefore natively SD-WAN-aware. Assoon as field endpoints are mapped to the correct tenants and network segment, they can bemanaged by remote network operators who belong to the same tenant(enterprise). Additional
Versa SD-WAN intelligence such as protected local breakout (DIA), and SaaS optimizations canalso be enabled.
Network Obfuscation
All Versa SASE Gateway comes with Network Obfuscation feature, which perfectly prevent
lateral movement of network attack if any of the endpoint is compromised. This enforcesdevices and user information are always isolated and protected.
Security and Policy Enforcement

7Copyright © 2023 Versa Inc.

Versa SASE Gateway comes with built-in security that supports modern security protocols like
CASB, NGFW, UTM, URL Filtering etc. As endpoint traffic going through the Versa SASE
Gateways, policy can be enforced based on many factors:
••
•
•
•

Source/Destination Address
Source/Destination Protocol and ports
Time of the day
Geo-location
User/Group

Importantly, policies are on per-tenant basis, each tenant in the deployment receives different
sets of policies based on requirement.

Why Versa Networks?
Versa SASE provides an excellent choice for enterprises, mobile network operators, andpartners to build their own private SASE service on their own premises or in their own private
cloud. This flexibility creates tremendous opportunities to gain full control over the services, yettake advantage of performance and capabilities of the market leading Versa SASE solution.
End-to-End Visibility and Control
Through a single-pane-of-glass interface, SASE offers complete visibility into users, devices, andapplications across the entire network- whether on-premises or in the cloud.
Consistent Security Enforcement
SASE enables security teams to bring cloud platforms, data centers, branch offices, remote andmobile users under one umbrella and protect them with one unified security policy pushed toevery user on any device, anywhere.
Optimized Application Performance
Versa SASE has application awareness and dynamic traffic steering capabilities that monitor
traffic patterns in real-time to analyze performance parameters such as latency, jitter, andpacket loss. Based on these parameters, Versa SASE automatically routes traffic over the idealtransport route. In doing so, it ensures all applications, especially voice and video, run
seamlessly and reliably for an uninterrupted user experience.
Lower Capital and Operational Expenses
Installing commodity point products in branch locations is costly. Enabling Versa on OEM
Hardware, Whitebox, Cloud or VM can dramatically bring down the total cost of ownership, andincrease flexibilities for enterprises.
8Copyright © 2023 Versa Inc.