Operator manual

The SASE console, screen by screen

How to build an overlay between your sites, let people in from outside it, and decide what each of them may reach — written for the person who has to do it, with every control named as it appears on screen.

11 chapters78 controls explainedWritten in English. The interface itself is English in every language.

Captures come from a running console. The estate in them is presented rather than reported: site names, hostnames, addresses and people are stand-ins, and every tunnel is shown established. What the interface itself says — every control, count and state — is untouched.

One idea holds the rest together

A tunnel proves a device, never a person. Everything in this manual that looks like extra work — binding a device to a directory, granting applications instead of networks, re-checking access on a deadline, asking what state the machine is in — exists because of that one gap. Build the overlay first; then close the gap.

01 · Six tabs, six questions

What the console is for

The SASE section has six tabs, and each answers one question. Knowing which tab answers which is most of the learning curve.

The Overlay tab with a topology selected: the six section tabs across the top, the palette of firewalls on the left, the toolbar above the canvas, and the tunnels drawn as the console last wrote them.

Controls · The six tabs

Overlaypanel: Where topologies are drawn, deployed and watched. This is where sites become a network.
SD-WANpanel: What each firewall's own agent measures on each of its uplinks. A window, not a control: the firewall chooses paths, five seconds at a time.
Private Accesspanel: People who connect from outside, and the devices they hold. One row per person, one card per device.
Securitypanel: Where the inspection actually happens, and the honest list of what this product does not do.
Monitorpanel: Health, alert rules, what fired, and the audit trail of every change the console made to a firewall.
Settingspanel: Four tabs of their own: who may connect, what they may reach, which networks exist, and how things are linked.

The Glossary button in the tab bar defines every term this product uses, including the ones it deliberately does not claim.
Nothing on the canvas is a drawing of an intention. A line is drawn from what the console has written to a firewall, and its colour says what that tunnel is actually doing.

6 controls explained

02 · Choosing a topology

The four shapes, and when each is right

A topology is a shape, a transport and an address range. The range is allocated for you and never overlaps another topology in the same organisation. The shape decides who dials whom — and, just as importantly, whose traffic passes an inspecting firewall.

Hub and spoke

Everything reaches one place. Start here unless you have a reason not to.

Traffic between two sites takes the long way round — and is inspected on the way.

Dual hub

An outage at the hub site must not take the other sites with it.

A second listening hub to run. It holds host routes only until it is needed.

Spoke shortcut

Two sites talk to each other enough that the detour costs real time.

That pair's traffic stops passing the hub, so it stops being inspected there.

Full mesh

Every pair talks to every other. Capped at eight sites.

Every site carries a peer for every other, and one node still brokers the pairs.

Established tunnelDirect path between two sitesStandby path — host routes only until failover

The New Topology dialog. Each shape carries what it is for; the transport below it decides what can be enforced afterwards.

Controls · Shapes

Every shape has exactly one primary hub: the node with an address the others can dial.

Hub and spokeselect: Every site dials one hub, and all traffic between sites passes through it. The simplest shape and the easiest to reason about, because everything crosses one engine. Choose it unless you have a reason not to.
Dual hubselect: A second listening hub that holds host routes only until it is needed. When the primary stops answering, the console moves every spoke across in one operation and moves them back once the primary has been stable again. Choose it when an outage at the hub site must not take the other sites with it.
Spoke shortcutselect: The hub stays the rendezvous point, but a configured pair of spokes is told each other's observed address and both ends hold a keepalive, so they open their own path through their NATs. Choose it when two branches talk to each other enough that the detour costs real time.
Full meshselect: Shortcuts for every pair, capped at eight sites because each site then carries a peer for every other. One node still holds the hub role: it brokers the pairs and carries any pair that cannot be joined directly.

Controls · Transports

WireGuardselect: The default, and the only one that carries every feature in this manual — per-device switching, shortcuts, per-device firewall rules. Keys are generated on the firewalls themselves.
OpenVPNselect: A per-topology certificate authority on the console. A device gets a certificate and the server hands it an address at connect time, which is precisely why per-device rules and the per-device switch do not apply to it.
GREselect: Site to site only, in /30 pairs. There is no remote-user enrolment on a GRE topology, and the dialog says so rather than letting you find out later.

The shape can be changed later; the transport cannot. Adding a second hub or turning on shortcuts is a change to an existing overlay. Moving from WireGuard to OpenVPN is a new topology and a re-enrolment of every person on it, because the keys, the addresses and the client configuration all differ.

A shortcut is a security decision as much as a performance one: traffic that stops transiting the hub also stops being inspected there. The spoke's own engine still sees it.

7 controls explained

03 · Hub and spoke, end to end

Building your first overlay

This is the whole procedure for the simplest shape. Every other shape is this one plus a difference, and the next chapter covers the differences.

The readiness card lists what is still missing, in the order it has to be fixed. A blocker disables Deploy, and the orchestrator refuses with the same sentence.

Hub and spoke, deployed: two spokes dialling one hub, each link carrying its measured latency.

Procedure

1
Create the topology
Overlay → New Topology. Name it for the estate rather than the technology — HQ and branches survives a transport change, WireGuard mesh does not. The name appears in every alert and in the audit trail.
2
Add the hub first
Drag the firewall that has an address the others can reach. Everything else dials it, so a firewall behind a NAT with no forwarded port cannot be a hub. The first node you drop is made the hub automatically, because a topology without one cannot be deployed at all.
3
Add the spokes
Drag each remaining firewall onto the canvas. A spoke needs only to reach the hub's address and port; it may sit behind any NAT, including a carrier-grade one.
4
Tell each site what it advertises
Open a node's settings, press Detect to read the networks behind that firewall, then move the ones the other sites should reach into Advertised subnets. Detecting a network does not publish it. A site that advertises nothing is reachable and leads nowhere, which is the most common reason a working tunnel looks useless.
5
Read the readiness card
It lists what is still missing, in the order it has to be fixed. A blocker disables Deploy — and the orchestrator refuses with the same sentence, so the button and the error never disagree.
6
Deploy
Press Deploy All. Keys are written first, then peer lists. Watch the links turn: a node that fails is marked and the others still converge, so one unreachable branch does not hold up the rest.
7
Prove it from a client, not from the console
From a machine behind one spoke, reach something behind another. A green line means the console wrote what it intended and the tunnel handshaked; it does not prove that the thing you wanted to reach is reachable.

Deploy All is a reconciliation, not an append. Pressing it again is safe, and a node that already matches is left alone.
History shows every deploy of this topology and what each node answered. Ops Log shows who pressed what. When something changed and nobody remembers doing it, start there.

04 · What changes, and what to watch

The other three shapes

Each of the remaining shapes is the hub-and-spoke procedure with one addition. None of them changes how a site advertises its networks or how it is deployed.

Dual hub. The second hub is drawn holding host routes only — it does not attract traffic while the primary answers.

A brokered pair. The link between the two spokes reads DIRECT once both ends have opened their own path.

Full mesh: every pair joined, each with its own latency, and one node still holding the hub role.

Controls · Dual hub

Set as Backup Hubmenu: Right-click a second listening node. It holds host routes only — it never quietly attracts traffic while the primary is healthy.
Failover classselect: How patient to be with a silent primary. It feeds the box-local monitor where that is enabled; the console's own failover uses the topology's silence threshold.
Promote Backupbutton: Triggers the swap yourself, with a preview of exactly which peers change on which node before anything is written.
Preferred hubselect: Where the sites belong when everything is healthy. Failback returns them there automatically once it has been stable for the configured window.

Controls · Spoke shortcut

Draw a link between two spokes and the console brokers the pair. Nothing else changes.

PROBINGbadge: The pair has been written and is trying to handshake. Both ends hold a keepalive so each opens its own NAT.
DIRECTbadge: The two ends are talking to each other. Their traffic no longer transits the hub.
VIA HUBbadge: The pair was measured and the hub path is better, or the direct path stopped handshaking. It is retried later; nothing is broken.
NO DIRECTbadge: The pair was refused, and the tooltip says why. Two sites behind one NAT are refused as a hairpin unless each one's reachable address is pinned in its node settings.

Controls · Full mesh

Adding a sitebutton: A new spoke is linked to every existing spoke automatically. The console repairs a missing pair rather than leaving a hole, so a mesh stays a mesh.
Removing a pairmenu: Refused. A mesh is defined by having every pair; if you want one pair gone, the shape you want is shortcuts, not a mesh.
Eight sitesbadge: The cap, because every site carries a peer for every other. Past that, the shape to reach for is shortcuts on the pairs that matter.

Automatic failover is opt-in per topology, and it is decided by the console: it waits out a silence threshold and confirms with a health check before moving anything. That takes minutes, not seconds. If you need a number for a maintenance window, use Promote Backup and measure it on your own estate.

11 controls explained

05 · What one site is and carries

Node settings, control by control

Everything that is true of one firewall inside one topology. Most of it has a safe default. The two that decide whether the overlay is useful at all are what the site advertises and whether its traffic leaves through the hub.

Connectivity settings: the tenant-wide defaults a node inherits before anything is overridden on the node itself.

Controls · Identity and role

Roleselect: Hub, backup hub, spoke or relay. A hub and a relay listen; a spoke dials. A relay is a listening transit node that does not hold the hub slot — it is not an internet relay for two sites that are both behind NAT.
Listen portnumber: The UDP port this node listens on. Fixed rather than random, because a shortcut partner is told this port and a port that moved on every deploy would break the pair.
Overlay IPtext: Assigned by the console from the topology's range. Read-only, because two nodes with the same address is a class of outage nobody should be able to cause by typing.

Controls · What it carries

Route all traffic through the hubtoggle: Sends this site's internet traffic through the hub for inspection instead of out of its own uplink. Off by default, deliberately. Turning it on at a site whose hub cannot carry the traffic takes that site off the internet.
Local subnets · Detectbutton: Reads the networks behind this firewall from the firewall itself. Detection fills the list; it publishes nothing.
Advertised subnetstext: What the other sites are told they can reach here. This is the field that makes a tunnel useful, and the one most often left empty.
Application Routing through this tunneltoggle: Gives a spoke a second, engine-native identity so application-routing rules can steer flows into the overlay while the hub still sees the real client address. Off means the overlay is a routed interface only.

Controls · Transport tuning

Keepalivenumber: How often a dialling node reminds the far side it is there, which is also what holds its NAT mapping open. 25 seconds suits almost everything.
MTUnumber: 1420 on ordinary Ethernet uplinks, 1380 where PPPoE eats the difference. Set too high, it shows up as large transfers stalling while pings succeed — the most misdiagnosed fault in any tunnel.
Rotate WireGuard keymenu: Has the firewall generate a new keypair and rewrites every peer that referred to the old one. The tunnel drops for as long as the rewrite takes.

10 controls explained

06 · Changing something that is live

Deploying, undoing and deleting

Every change here is a reconciliation rather than an edit: the console works out the difference between what a firewall has and what it should have, and writes only that. Which is why removing things is as safe as adding them, and why an unreachable firewall stops a removal on purpose.

Deploy All writes the whole topology; History and Ops Log record what each firewall answered.

Controls · Removing

Remove from topologymenu: Takes one firewall out. Its instance is destroyed on the box and every remaining node is rewritten without it, so nothing is left dialling something that is gone. The firewall stays registered and can be used elsewhere.
Disconnectmenu: Removes one tunnel between two spokes. In a full mesh this is refused, because the shape is defined by having every pair.
Deactivatebutton: Stops the overlay without forgetting it: instances come down, the design stays. Reactivating redeploys it as it was.
Delete topologybutton: Type the name to confirm. Every instance on every node is torn down before the record is removed. Remote users of that topology lose access and their configuration files cannot be reused.

If a firewall cannot be reached, its tunnel cannot be torn down — and forgetting it here would leave a live instance on a box nobody is managing any more. The console refuses and names the node. Forcing it is possible, and says plainly that state will linger on that box.

4 controls explained

07 · Enrolling a device

Letting a person in

Two channels, on purpose: the link identifies the enrolment and the password authorises it, so sending both the same way defeats the point. The private key is generated in the person's own browser and never reaches the console — which is also why a lost configuration file cannot be re-sent, only re-issued.

Enrolling a device. The person comes from the directory, the device name is what posture matches on, and the block at the bottom states what will be true of this access before the link is sent.

Procedure

1
Find the person in your directory
Searching fills their address and name from the same directory that will assert them at sign-in, and shows which access group they will land in and what they will reach — before anything is sent. Typing an address by hand works too, and produces an unbound device.
2
Name the device
Use the machine's name as your management system knows it. Device posture matches on it; without it, the person's most recently seen machine is judged instead.
3
Pick the topology
The device reaches that overlay's sites and no others.
4
Choose the tunnel scope
Split sends only corporate networks down the tunnel. Full sends everything, which is what you want when the traffic must be inspected and what you do not want when the hub cannot carry it.
5
Choose where their internet leaves
The hub, one named site, or whichever site is nearest to where the person is connecting from right now. Nearest re-evaluates as they move; the configuration file never changes.
6
Send the two halves apart
The dialog shows the link and the password once. There is no way to see them again — mint a new link instead. Mail one, read the other out, or use a different messenger.

Controls · Fields worth understanding

Person (from your directory)text: Searches the people synced from Entra, Google Workspace or SCIM. Picking one fills the address and name and shows their groups and the access group they resolve to.
Email addresstext: The key for everything afterwards: the sign-in must match it, and the posture source is asked about this address.
Link expires afterselect: How long the one-time link stays usable. Short is better — it only has to survive the time between sending it and the person opening it.
Allowed subnetstext: Client-side routing only: it tells the person's machine what to send down the tunnel. It is not a firewall rule. When an access group applies, that group's destinations replace this list and the hub enforces them.
What will apply to this accesspanel: The four things that will be true of the device once it exists: whether a sign-in is required, when access is re-checked, whether the machine's state is enforced, and what the hub will allow. All set elsewhere, shown here so nobody enrols under assumptions that do not hold.

5 controls explained

08 · Suspending, reinstating, revoking

Devices after they exist

One row per person, expanding to one card per device. A person is an address; a device is a peer with its own key and its own fixed overlay address. Policy follows the person, enforcement lands on the device.

Private Access: one row per person, and the Zero Trust card above it saying which of the four answers this organisation has switched on.

A device card expanded: its badges, its access row with the deadline and the operator's overrides, and where its internet traffic leaves.

Controls · Badges

Active · suspended · expired · revokedbadge: Suspended is the console holding the device off at the hub — for a lapsed sign-in, an account the directory disabled, or a machine reported non-compliant. The reason is on the card.
identity · unboundbadge: Whether the device is bound to a person at a provider, or was enrolled with a link and a password only and is therefore time-limited rather than identity-limited.
device ok · at risk · unknownbadge: What the management system says about the machine. Absent entirely when device posture is off, because a badge nothing is maintaining is worse than no badge.

Controls · Actions

Require sign-inbutton: Puts the device into re-authentication now instead of at its deadline. A reminder is mailed and the link is copied for any other channel.
Copy sign-in linkbutton: The same link that lives as a comment in the person's configuration file, for when they cannot find it.
Extendbutton: Moves the deadline and reinstates a suspended device. An operator override, logged as one.
Check nowbutton: Asks the management system about this machine immediately and applies whatever the mode calls for. Use it after fixing a laptop instead of waiting for the next sweep.
Revokebutton: Removes the peer from the hub and releases its address. The configuration file stops working immediately and cannot be un-revoked.

Revoking a device is not the same as removing a person. Someone with a laptop and a phone holds two peers; revoking one leaves the other connected. The device count on their row is there to make that obvious.

8 controls explained

09 · Settings → Identity

Who may connect

Two different jobs share this tab. A directory tells the console who exists and which groups they are in. A sign-in provider proves, at enrolment and at every re-check, that the person in front of the browser is that person. A tenant can have several of the first and one of the second.

Identity: the sign-in provider at the top, then every directory the console reads people and groups from.

The sign-in provider dialog. The redirect URI at the bottom is the one address to allow at the provider.

Controls · The sign-in provider

Providerselect: Google Workspace, Microsoft Entra ID, or any provider with an OpenID Connect discovery document. Separate from the console's own operator login.
Require sign-in for every new enrolmenttoggle: Off means devices keep enrolling with a link and a password and show as unbound. On means no device is created until someone has proved who they are.
Require multi-factortoggle: Checks the token's amr claim for a multi-factor sign-in. The factor is the provider's; the console refuses a token that does not carry the claim.
Sign in again every N hoursnumber: The re-authentication interval. A reminder goes a day ahead; at the deadline the device is switched off at the hub until the person signs in again.
Redirect URItext: The one address to allow at the provider. Which enrolment a sign-in belongs to travels in the state parameter, so one URI serves the whole console.

Controls · Identity sources

Kindselect: Active Directory, RADIUS, Entra, Google Workspace or SCIM. Each can verify people, read the directory, or both — a RADIUS server can verify but cannot be enumerated, and the dialog only offers what the protocol supports.
Sync nowbutton: Reads the directory immediately instead of waiting for the interval. The counts on the row are the result of the last read, not an estimate.
Testbutton: Proves the credentials and, for a source that can verify people, proves one person's sign-in without creating anything.

A directory that reports someone as disabled suspends their devices without waiting for the deadline. That is the fastest off-switch in the product, and it is the directory's, not the console's.

8 controls explained

10 · Settings → Access

What they may reach, and on what machine

Three cards, read top to bottom. A group says who. An application says which service. Posture says on what machine. The hub turns the first two into firewall rules per person — their destinations, DNS at the hub, and a drop for everything else — evaluated before the rule that lets the tunnel in at all.

Access: groups, applications and device posture, read top to bottom — who, which service, on what machine.

An application is an address and the ports it answers on. Leaving the ports empty is allowed and means every port, and the dialog says so.

Device posture. Observe reads and shows; enforce switches a non-compliant device off and lets it back in by itself.

An access group maps directory groups to applications and networks. Without a default group, whoever matches nothing keeps open access.

Controls · Access groups

Provider groupstext: The group names as your provider reports them, matched case-insensitively against what the person's sign-in carried.
Applications this group may reachpanel: Named services with their ports. This is the narrow grant, and the one to reach for first.
Whole networkstext: IPv4 ranges granted on every port. Wider than an application, and sometimes exactly right — a management network for the people who run it.
Default grouptoggle: Applies to everyone who matches nothing else, including unbound devices. Give it the least you can live with.
Reapply on hubsbutton: Rewrites every hub's rules from the current groups. This happens automatically after every enrolment, sign-in, suspension and group change; the button is for when you want to be sure.

Controls · Applications

Where a service lives and which ports it answers on.

Where it livestext: One or more IPv4 ranges. A single host is a /32, and a /32 is usually the right answer.
Which portstext: 443, 8000-8080, or udp/53. Without a protocol a port is read as tcp. Each protocol becomes its own firewall rule, because that is how the packet filter reads them.
Enabledtoggle: Off keeps the application on the groups that grant it but stops granting it — the quickest way to take a service out of reach without unpicking policy.

Controls · Device posture

Read from the management system you already run. Nothing of ours is installed on the endpoint.

Off · Observe · Enforceselect: Off reads nothing. Observe reads and shows. Enforce switches a non-compliant device off and lets it back in by itself once the machine is healthy. Turning it back down releases everything it had switched off.
Read fromselect: Intune uses its own compliance verdict plus disk encryption and the threat state its security product reports. CrowdStrike Falcon has no compliance verdict, so the question asked is the one it can answer: whether the sensor is installed and running.
Read each device again everynumber: How often a device is re-read. A management API is a shared resource; this is the dial that stops a thousand laptops being asked about every minute.
Also switch off machines nobody can speak fortoggle: The strict reading. Leave it off unless every machine is enrolled — with it on, a broken connector disconnects everybody.
Event URLbutton: A token-gated address your management system can call the moment something changes. It can ask for a device to be re-read, or report one compromised; it cannot assert that a device is healthy. Shown once; minting a new one retires the old.

Without a default group, a person whose directory groups match nothing — and every device enrolled without a sign-in — reaches whatever the tunnel routes, because nothing is enforced for them. That is a choice to make deliberately, not one to discover.

Run posture in observe for a working day and count how many devices read unknown. That number is exactly how many people enforcing would disconnect if you also ticked the strict reading.
An application with an empty port list is a network grant with a friendlier name. Allowed, and sometimes right, but it is not least privilege.

13 controls explained

11 · SD-WAN and Monitor

Watching it afterwards

Two tabs, two different questions. SD-WAN asks how each uplink is performing; Monitor asks whether the overlay itself is healthy and records what was done to it.

SD-WAN: what each firewall's own agent measures on each uplink. The console does not choose paths.

Monitor: health, the alert rules worth waking someone for, and the log of every change the console made to a firewall.

Controls · SD-WAN

Target rowpanel: One uplink or tunnel on one firewall: latency, loss, jitter and the composite score, with the current best marked. An overlay tunnel appears beside the physical links and competes on the same score.
Open Application Routingbutton: Jumps to that firewall's own routing rules, where the steering is actually written. The console does not choose paths; the firewall does, five seconds at a time.
No SLA agent on this platformbadge: That node cannot measure. Its tunnels still work — they are simply not scored, and a rule that says best will not consider them.

Controls · Monitor

Healthpanel: Per-hub checks and per-spoke latency, loss and jitter, measured by the hub on every poll. Probe now takes a fresh reading instead of waiting.
Alert rulespanel: Failover fired or restored, both hubs down, a spoke offline, loss or latency past a threshold, a deploy that failed. Delivered by mail, webhook or Slack, with a cooldown so one flapping link does not become a hundred messages.
Operation logpanel: Every change the console made to a firewall and the answer it got back. The first place to look when something changed and nobody remembers doing it.

6 controls explained

If you read one thing twice

Build the overlay, then close the gap the tunnel leaves. A key proves a device; a directory proves a person; an access group decides what that person reaches; a deadline keeps it true; and the management system you already run says whether the machine in their hands should be there at all. Each of those is one screen in this manual, and each one is optional — which is exactly why it is worth knowing which ones you have turned on.