Secure SD-WAN
The network half of SASE: encrypted overlays between your sites, provisioned from one topology view, and per-application control over which uplink each flow leaves by.
The decision is made per session, from what the traffic is rather than which subnet it came from — and it is remade when a link degrades.
The firewalls a customer already has, listed by site. Drag one onto the canvas and it becomes a spoke or the hub.
Everything arriving at the primary hub meets the same policy: application control, IDS/IPS, TLS inspection, DLP and the AI gateway.
Up or down, latency, bytes in each direction — on the link, where you are looking, not in a log you would have to open.
How quickly spokes move to a backup hub when the primary stops answering is a setting of the drawing, not of each firewall.
The canvas knows when it differs from what the firewalls run. One button writes the configuration for both ends of every tunnel and pushes it.
Zedmos
The application, its category, the TLS server name or the domain — whichever the rule selects on. Not the port, because the port stopped identifying anything years ago.
You
A second internet line, a tunnel, or a specific interface. You also say what should happen if that target is unusable: fall back, or drop — so traffic that must only ever cross the tunnel cannot quietly take the open line instead.
Zedmos
Every candidate is probed on a short cycle and scored on loss, latency and jitter. A line that is up and losing four per cent of packets ruins a call while passing every up/down check — scoring is what catches it.
Zedmos
The session leaves by the chosen link, with the rule and the egress written to the record — so the question of why traffic went a particular way has an answer.
Addressing, keys and routes are worked out for you. Each mesh gets a unique range, each node an address from it, and every peer's allowed routes are recomputed when the topology changes. Keys are generated on the firewall itself and only the public half is ever collected.
WireGuard for most deployments. OpenVPN where a certificate-based estate is already the standard and the operations team knows it. GRE where the transport is already private and you want routing without a second layer of encryption. The console tells you what each choice means before you commit to it.
A backup hub holds host-only routes while the primary is healthy, so it never quietly attracts traffic. When the primary stops answering, the console moves every spoke across — automatically once you enable it, or on your command with a preview of exactly what will change.
A rule selects traffic by application, category, TLS server name or domain, and names the uplink it should leave by: a second WAN, a WireGuard, OpenVPN or GRE tunnel, or an ordinary interface. If that target is unhealthy the rule can fall back to another — or drop, so a flow that must only ever traverse the tunnel does not quietly leave over the open WAN instead.
Every candidate uplink is probed on a five-second cycle over ICMP, DNS or HTTP, and scored on packet loss, latency and jitter across a rolling window. A tunnel is judged by whether its handshake is current, not by whether the interface exists. Hysteresis keeps a borderline link from flapping.
Demo & pricing: info@zedmos.com
Request a demo