The SASE console, screen by screen

Bedienelemente · The six tabs

Overlaypanel

Where topologies are drawn, deployed and watched. This is where sites become a network.

SD-WANpanel

What each firewall's own agent measures on each of its uplinks. A window, not a control: the firewall chooses paths, five seconds at a time.

Private Accesspanel

People who connect from outside, and the devices they hold. One row per person, one card per device.

Securitypanel

Where the inspection actually happens, and the honest list of what this product does not do.

Monitorpanel

Health, alert rules, what fired, and the audit trail of every change the console made to a firewall.

Settingspanel

Four tabs of their own: who may connect, what they may reach, which networks exist, and how things are linked.

Bedienelemente · Shapes

Every shape has exactly one primary hub: the node with an address the others can dial.

Hub and spokeselect

Every site dials one hub, and all traffic between sites passes through it. The simplest shape and the easiest to reason about, because everything crosses one engine. Choose it unless you have a reason not to.

Dual hubselect

A second listening hub that holds host routes only until it is needed. When the primary stops answering, the console moves every spoke across in one operation and moves them back once the primary has been stable again. Choose it when an outage at the hub site must not take the other sites with it.

Spoke shortcutselect

The hub stays the rendezvous point, but a configured pair of spokes is told each other's observed address and both ends hold a keepalive, so they open their own path through their NATs. Choose it when two branches talk to each other enough that the detour costs real time.

Full meshselect

Shortcuts for every pair, capped at eight sites because each site then carries a peer for every other. One node still holds the hub role: it brokers the pairs and carries any pair that cannot be joined directly.

Bedienelemente · Transports

WireGuardselect

The default, and the only one that carries every feature in this manual — per-device switching, shortcuts, per-device firewall rules. Keys are generated on the firewalls themselves.

OpenVPNselect

A per-topology certificate authority on the console. A device gets a certificate and the server hands it an address at connect time, which is precisely why per-device rules and the per-device switch do not apply to it.

GREselect

Site to site only, in /30 pairs. There is no remote-user enrolment on a GRE topology, and the dialog says so rather than letting you find out later.

Vorgehen

1. 1

   Create the topology

   Overlay → New Topology. Name it for the estate rather than the technology — HQ and branches survives a transport change, WireGuard mesh does not. The name appears in every alert and in the audit trail.
2. 2

   Add the hub first

   Drag the firewall that has an address the others can reach. Everything else dials it, so a firewall behind a NAT with no forwarded port cannot be a hub. The first node you drop is made the hub automatically, because a topology without one cannot be deployed at all.
3. 3

   Add the spokes

   Drag each remaining firewall onto the canvas. A spoke needs only to reach the hub's address and port; it may sit behind any NAT, including a carrier-grade one.
4. 4

   Tell each site what it advertises

   Open a node's settings, press Detect to read the networks behind that firewall, then move the ones the other sites should reach into Advertised subnets. Detecting a network does not publish it. A site that advertises nothing is reachable and leads nowhere, which is the most common reason a working tunnel looks useless.
5. 5

   Read the readiness card

   It lists what is still missing, in the order it has to be fixed. A blocker disables Deploy — and the orchestrator refuses with the same sentence, so the button and the error never disagree.
6. 6

   Deploy

   Press Deploy All. Keys are written first, then peer lists. Watch the links turn: a node that fails is marked and the others still converge, so one unreachable branch does not hold up the rest.
7. 7

   Prove it from a client, not from the console

   From a machine behind one spoke, reach something behind another. A green line means the console wrote what it intended and the tunnel handshaked; it does not prove that the thing you wanted to reach is reachable.

Bedienelemente · Dual hub

Set as Backup Hubmenu

Right-click a second listening node. It holds host routes only — it never quietly attracts traffic while the primary is healthy.

Failover classselect

How patient to be with a silent primary. It feeds the box-local monitor where that is enabled; the console's own failover uses the topology's silence threshold.

Promote Backupbutton

Triggers the swap yourself, with a preview of exactly which peers change on which node before anything is written.

Preferred hubselect

Where the sites belong when everything is healthy. Failback returns them there automatically once it has been stable for the configured window.

Bedienelemente · Spoke shortcut

Draw a link between two spokes and the console brokers the pair. Nothing else changes.

PROBINGbadge

The pair has been written and is trying to handshake. Both ends hold a keepalive so each opens its own NAT.

DIRECTbadge

The two ends are talking to each other. Their traffic no longer transits the hub.

VIA HUBbadge

The pair was measured and the hub path is better, or the direct path stopped handshaking. It is retried later; nothing is broken.

NO DIRECTbadge

The pair was refused, and the tooltip says why. Two sites behind one NAT are refused as a hairpin unless each one's reachable address is pinned in its node settings.

Bedienelemente · Full mesh

Adding a sitebutton

A new spoke is linked to every existing spoke automatically. The console repairs a missing pair rather than leaving a hole, so a mesh stays a mesh.

Removing a pairmenu

Refused. A mesh is defined by having every pair; if you want one pair gone, the shape you want is shortcuts, not a mesh.

Eight sitesbadge

The cap, because every site carries a peer for every other. Past that, the shape to reach for is shortcuts on the pairs that matter.

Bedienelemente · Identity and role

Roleselect

Hub, backup hub, spoke or relay. A hub and a relay listen; a spoke dials. A relay is a listening transit node that does not hold the hub slot — it is not an internet relay for two sites that are both behind NAT.

Listen portnumber

The UDP port this node listens on. Fixed rather than random, because a shortcut partner is told this port and a port that moved on every deploy would break the pair.

Overlay IPtext

Assigned by the console from the topology's range. Read-only, because two nodes with the same address is a class of outage nobody should be able to cause by typing.

Bedienelemente · What it carries

Route all traffic through the hubtoggle

Sends this site's internet traffic through the hub for inspection instead of out of its own uplink. Off by default, deliberately. Turning it on at a site whose hub cannot carry the traffic takes that site off the internet.

Local subnets · Detectbutton

Reads the networks behind this firewall from the firewall itself. Detection fills the list; it publishes nothing.

Advertised subnetstext

What the other sites are told they can reach here. This is the field that makes a tunnel useful, and the one most often left empty.

Application Routing through this tunneltoggle

Gives a spoke a second, engine-native identity so application-routing rules can steer flows into the overlay while the hub still sees the real client address. Off means the overlay is a routed interface only.

Bedienelemente · Transport tuning

Keepalivenumber

How often a dialling node reminds the far side it is there, which is also what holds its NAT mapping open. 25 seconds suits almost everything.

MTUnumber

1420 on ordinary Ethernet uplinks, 1380 where PPPoE eats the difference. Set too high, it shows up as large transfers stalling while pings succeed — the most misdiagnosed fault in any tunnel.

Rotate WireGuard keymenu

Has the firewall generate a new keypair and rewrites every peer that referred to the old one. The tunnel drops for as long as the rewrite takes.

Bedienelemente · Removing

Remove from topologymenu

Takes one firewall out. Its instance is destroyed on the box and every remaining node is rewritten without it, so nothing is left dialling something that is gone. The firewall stays registered and can be used elsewhere.

Disconnectmenu

Removes one tunnel between two spokes. In a full mesh this is refused, because the shape is defined by having every pair.

Deactivatebutton

Stops the overlay without forgetting it: instances come down, the design stays. Reactivating redeploys it as it was.

Delete topologybutton

Type the name to confirm. Every instance on every node is torn down before the record is removed. Remote users of that topology lose access and their configuration files cannot be reused.

Vorgehen

1. 1

   Find the person in your directory

   Searching fills their address and name from the same directory that will assert them at sign-in, and shows which access group they will land in and what they will reach — before anything is sent. Typing an address by hand works too, and produces an unbound device.
2. 2

   Name the device

   Use the machine's name as your management system knows it. Device posture matches on it; without it, the person's most recently seen machine is judged instead.
3. 3

   Pick the topology

   The device reaches that overlay's sites and no others.
4. 4

   Choose the tunnel scope

   Split sends only corporate networks down the tunnel. Full sends everything, which is what you want when the traffic must be inspected and what you do not want when the hub cannot carry it.
5. 5

   Choose where their internet leaves

   The hub, one named site, or whichever site is nearest to where the person is connecting from right now. Nearest re-evaluates as they move; the configuration file never changes.
6. 6

   Send the two halves apart

   The dialog shows the link and the password once. There is no way to see them again — mint a new link instead. Mail one, read the other out, or use a different messenger.

Bedienelemente · Fields worth understanding

Person (from your directory)text

Searches the people synced from Entra, Google Workspace or SCIM. Picking one fills the address and name and shows their groups and the access group they resolve to.

Email addresstext

The key for everything afterwards: the sign-in must match it, and the posture source is asked about this address.

Link expires afterselect

How long the one-time link stays usable. Short is better — it only has to survive the time between sending it and the person opening it.

Allowed subnetstext

Client-side routing only: it tells the person's machine what to send down the tunnel. It is not a firewall rule. When an access group applies, that group's destinations replace this list and the hub enforces them.

What will apply to this accesspanel

The four things that will be true of the device once it exists: whether a sign-in is required, when access is re-checked, whether the machine's state is enforced, and what the hub will allow. All set elsewhere, shown here so nobody enrols under assumptions that do not hold.

Bedienelemente · Badges

Active · suspended · expired · revokedbadge

Suspended is the console holding the device off at the hub — for a lapsed sign-in, an account the directory disabled, or a machine reported non-compliant. The reason is on the card.

identity · unboundbadge

Whether the device is bound to a person at a provider, or was enrolled with a link and a password only and is therefore time-limited rather than identity-limited.

device ok · at risk · unknownbadge

What the management system says about the machine. Absent entirely when device posture is off, because a badge nothing is maintaining is worse than no badge.

Bedienelemente · Actions

Require sign-inbutton

Puts the device into re-authentication now instead of at its deadline. A reminder is mailed and the link is copied for any other channel.

Copy sign-in linkbutton

The same link that lives as a comment in the person's configuration file, for when they cannot find it.

Extendbutton

Moves the deadline and reinstates a suspended device. An operator override, logged as one.

Check nowbutton

Asks the management system about this machine immediately and applies whatever the mode calls for. Use it after fixing a laptop instead of waiting for the next sweep.

Revokebutton

Removes the peer from the hub and releases its address. The configuration file stops working immediately and cannot be un-revoked.

Bedienelemente · The sign-in provider

Providerselect

Google Workspace, Microsoft Entra ID, or any provider with an OpenID Connect discovery document. Separate from the console's own operator login.

Require sign-in for every new enrolmenttoggle

Off means devices keep enrolling with a link and a password and show as unbound. On means no device is created until someone has proved who they are.

Require multi-factortoggle

Checks the token's amr claim for a multi-factor sign-in. The factor is the provider's; the console refuses a token that does not carry the claim.

Sign in again every N hoursnumber

The re-authentication interval. A reminder goes a day ahead; at the deadline the device is switched off at the hub until the person signs in again.

Redirect URItext

The one address to allow at the provider. Which enrolment a sign-in belongs to travels in the state parameter, so one URI serves the whole console.

Bedienelemente · Identity sources

Kindselect

Active Directory, RADIUS, Entra, Google Workspace or SCIM. Each can verify people, read the directory, or both — a RADIUS server can verify but cannot be enumerated, and the dialog only offers what the protocol supports.

Sync nowbutton

Reads the directory immediately instead of waiting for the interval. The counts on the row are the result of the last read, not an estimate.

Testbutton

Proves the credentials and, for a source that can verify people, proves one person's sign-in without creating anything.

Bedienelemente · Access groups

Provider groupstext

The group names as your provider reports them, matched case-insensitively against what the person's sign-in carried.

Applications this group may reachpanel

Named services with their ports. This is the narrow grant, and the one to reach for first.

Whole networkstext

IPv4 ranges granted on every port. Wider than an application, and sometimes exactly right — a management network for the people who run it.

Default grouptoggle

Applies to everyone who matches nothing else, including unbound devices. Give it the least you can live with.

Reapply on hubsbutton

Rewrites every hub's rules from the current groups. This happens automatically after every enrolment, sign-in, suspension and group change; the button is for when you want to be sure.

Bedienelemente · Applications

Where a service lives and which ports it answers on.

Where it livestext

One or more IPv4 ranges. A single host is a /32, and a /32 is usually the right answer.

Which portstext

443, 8000-8080, or udp/53. Without a protocol a port is read as tcp. Each protocol becomes its own firewall rule, because that is how the packet filter reads them.

Enabledtoggle

Off keeps the application on the groups that grant it but stops granting it — the quickest way to take a service out of reach without unpicking policy.

Bedienelemente · Device posture

Read from the management system you already run. Nothing of ours is installed on the endpoint.

Off · Observe · Enforceselect

Off reads nothing. Observe reads and shows. Enforce switches a non-compliant device off and lets it back in by itself once the machine is healthy. Turning it back down releases everything it had switched off.

Read fromselect

Intune uses its own compliance verdict plus disk encryption and the threat state its security product reports. CrowdStrike Falcon has no compliance verdict, so the question asked is the one it can answer: whether the sensor is installed and running.

Read each device again everynumber

How often a device is re-read. A management API is a shared resource; this is the dial that stops a thousand laptops being asked about every minute.

Also switch off machines nobody can speak fortoggle

The strict reading. Leave it off unless every machine is enrolled — with it on, a broken connector disconnects everybody.

Event URLbutton

A token-gated address your management system can call the moment something changes. It can ask for a device to be re-read, or report one compromised; it cannot assert that a device is healthy. Shown once; minting a new one retires the old.

Bedienelemente · SD-WAN

Target rowpanel

One uplink or tunnel on one firewall: latency, loss, jitter and the composite score, with the current best marked. An overlay tunnel appears beside the physical links and competes on the same score.

Open Application Routingbutton

Jumps to that firewall's own routing rules, where the steering is actually written. The console does not choose paths; the firewall does, five seconds at a time.

No SLA agent on this platformbadge

That node cannot measure. Its tunnels still work — they are simply not scored, and a rule that says best will not consider them.

Bedienelemente · Monitor

Healthpanel

Per-hub checks and per-spoke latency, loss and jitter, measured by the hub on every poll. Probe now takes a fresh reading instead of waiting.

Alert rulespanel

Failover fired or restored, both hubs down, a spoke offline, loss or latency past a threshold, a deploy that failed. Delivered by mail, webhook or Slack, with a cooldown so one flapping link does not become a hundred messages.

Operation logpanel

Every change the console made to a firewall and the answer it got back. The first place to look when something changed and nobody remembers doing it.