Netcraft is a member of the Versa ACE Partner Program, with offices in Adelaide and Suva (Fiji). We design, build and operate Versa SD-WAN and SASE deployments for businesses across Australia and the Pacific. Engagements range from single-region branch rollouts to multi-country WANs spanning Australia, Fiji, PNG and the Solomon Islands.
Most of our Versa work falls into three buckets: retiring an expensive MPLS WAN, consolidating a stack of branch routers and stand-alone firewalls onto a single platform, or replacing a legacy SSL VPN with Zero Trust Network Access for a remote workforce. In each case we deliver the right Versa appliances or virtualised CSGs, secure-access policy tuned to your applications, and 24×7 support backed by 30 years of Linux engineering.
We size Versa deployments against your actual site list, application mix and underlay options — not a generic reference design. Branch CSGs, regional hubs, dual-underlay policy (MPLS plus internet, fibre plus 4G), QoS classes matched to your applications, and a rollout sequence that keeps the business running while sites cut over in waves.
Versa Secure Access converges SD-WAN with secure web gateway, CASB and next-generation firewall into a single policy. Branch traffic, SaaS traffic and remote-user traffic all hit the same enforcement points with the same rules. One management plane covers the whole stack, so there is no policy drift between separate products. See also our broader security services.
Replace legacy SSL VPN concentrators with ZTNA: per-user, per-application access decisions made on identity, device posture and context. Versa Secure Access agents deliver this from cloud points-of-presence, so remote users get the same policy as branch users, including contractors and BYOD, without exposing the full corporate network.
Native cloud on-ramp into AWS Transit Gateway, Azure vWAN and GCP. Branch traffic reaches SaaS and IaaS workloads directly, with no trombone routing through head office, and the cloud exits live under the same SD-WAN policy as everything else.
We have run Versa migrations off Cisco, Juniper and vendor-managed MPLS WANs. Typical engagements move 30 to 80 sites in scheduled waves over 3–6 months, with the MPLS and Versa WANs running in parallel until each site is stable. Most customers retire the MPLS contract entirely; some keep a smaller MPLS footprint for the few sites where it still pays.
Engineers on-call 24×7 from our Adelaide and Suva (Fiji) offices for production Versa estates, under our Gold and Platinum infrastructure support tiers. Local hands available across Australia, Fiji, PNG and the Solomon Islands when on-site work is needed.
Indicative comparison. We’ll size and price your specific environment as part of any engagement.
| Capability | Versa SD-WAN & SASE | Traditional MPLS | IPsec VPN mesh |
|---|---|---|---|
| Cost model | Subscription per site / per user | $$$ per-circuit, long contract | $ per-appliance + telco |
| Underlay flexibility | Any (MPLS, internet, 4G/5G, satellite) | Carrier MPLS only | Any internet circuit |
| Application steering | Per-app, real-time, dynamic | Static QoS classes | None |
| Inline security (SWG / CASB / NGFW) | Built-in (unified SASE) | Separate stack required | None |
| ZTNA / remote workforce | Built-in (Versa Secure Access) | Separate VPN required | VPN only |
| Multi-cloud on-ramp | Native (AWS, Azure, GCP) | Carrier-dependent | Manual per-cloud |
| Path conditioning (FEC, packet dup) | Built-in | None | None |
| Centralised policy / observability | Single management plane | Carrier portal | Per-device CLI |
| Vendor lock-in risk | Medium | High | Low |
MPLS still works fine. It just costs too much for what it now delivers. Internet capacity is cheap, and the SLAs that used to justify the MPLS price tag are increasingly available from a properly designed SD-WAN over commodity links. At the same time the perimeter has dissolved. Staff log in from anywhere, applications live in SaaS, and the old stack of point-products (firewall, web filter, CASB, VPN) can’t keep up. SASE consolidates that stack onto one platform with one policy.
For Pacific customers the path-conditioning story is often the decider. Versa was built for unreliable underlays: forward-error-correction, packet duplication, jitter buffers. A single policy survives one or two underlays going degraded. We deploy across mixed environments of terrestrial fibre, fixed wireless, 4G/LTE and Starlink, with the platform steering traffic based on real-time link health.
Government, health and education customers across Australia and the Pacific increasingly need clear policy for where traffic is decrypted, inspected and logged. Versa lets us keep that enforcement on-shore where required, while still delivering the SASE consumption model.
Most engagements start with a week-zero discovery: audit the current WAN and security stack, capture the site list, application mix, underlay options and policy requirements. Weeks 1–3 are the design phase, covering Versa appliance sizing, underlay plan, security policy, ZTNA and SASE design, cloud on-ramp, migration runbook and rollback plan.
Pilot runs in weeks 3–6, with two or three sites cut over alongside the existing WAN. We always include at least one Pacific or remote site in the pilot if scope allows, since that is where the policy needs the most tuning. Rollout follows in weeks 6–20: remaining sites move in waves of two to four per week, with MPLS and legacy firewalls or VPN decommissioned region by region as each stabilises. After cutover we transition to ongoing 24×7 support and hands-on knowledge transfer with your team.
Tell us about your current environment (site count, underlay types, security stack, remote-user count and any cloud footprint) and we’ll come back with a sized Versa proposal and first-year support estimate. Most quotes land within 48 hours.
Versa Networks™, Versa™ and VOS™ are trademarks of Versa Networks, Inc. Netcraft Australia is a member of the Versa ACE Partner Program.
Yes. Netcraft is a member of the Versa ACE Partner Program. From our Adelaide and Suva (Fiji) offices we design, deploy and operate Versa SD-WAN and SASE for customers across Australia and the Pacific.
SASE (Secure Access Service Edge) converges SD-WAN with cloud-delivered security: secure web gateway, CASB, ZTNA and next-generation firewall, all running on the same VOS software stack and the same appliances that handle the SD-WAN. The point is fewer boxes to integrate, and the same policy reaching branches, cloud and remote users from a single management plane.
Most of our Versa engagements retire one of three things: an expensive MPLS WAN where the bandwidth costs no longer justify the SLAs, a stack of branch routers and stand-alone firewalls that have grown organically, or a legacy IPsec VPN mesh that is brittle and slow. Versa replaces all three with a single platform that does dynamic path selection across any underlay (MPLS, internet, 4G/5G, satellite), inline security, and centralised policy.
Yes. Versa Secure Access (the SASE service) provides ZTNA-based remote access for users and contractors, plus secure web gateway and CASB for cloud-application traffic. Most customers we migrate retire a legacy SSL VPN concentrator and a separate web-filter proxy in the same project, replacing them with Versa Secure Access agents and policy delivered from Versa’s cloud points-of-presence.
Yes. A typical MPLS-to-Versa migration runs in three phases: pilot 2–3 sites in parallel with the MPLS WAN (4–6 weeks), cut remaining sites in waves (2–4 sites per week), then decommission MPLS once everything is stable. End-to-end timelines depend on site count and security-policy complexity, but 30–80 sites in 3–6 months is common.
Well. Versa’s path-conditioning (FEC, packet duplication, jitter buffer) was built for exactly this kind of underlay. We deploy Versa across mixed environments — terrestrial fibre, fixed wireless, 4G/LTE and Starlink — and let the platform steer traffic based on real-time link health. For Pacific customers this is often the primary reason to deploy Versa: a single policy that survives one or two underlays going degraded.
Yes. Versa has native cloud on-ramp for the major hyperscalers (AWS Transit Gateway, Azure vWAN, GCP) so branch traffic can reach SaaS and IaaS workloads without trombone routing. We design the cloud interconnect as part of the engagement and tune routing policy to keep latency-sensitive applications on the right path.
It can. Versa includes a next-generation firewall in the same software stack as the SD-WAN and SASE services, with IPS, application control, URL filtering, anti-malware and DNS security. For branch sites we usually retire the existing perimeter firewall and consolidate onto Versa. For data centres with very high-throughput requirements we may keep the existing firewall and let Versa handle the WAN and SASE side, sized to the customer’s traffic profile.
Versa is licensed per site and per user, with bundles for SD-WAN-only, SASE-only or full unified SASE. Hardware is either Versa-supplied appliances (CSGs) or qualified white-box. Most customers see total-cost-of-ownership savings of 30–50% vs MPLS+firewall+VPN+web-filter when all the line items are added up. We size and quote against your actual site list and traffic profile.
Yes. Our engineers are on-call 24×7 for production Versa environments under our Gold and Platinum support tiers, with the on-call roster shared between our Adelaide and Suva (Fiji) offices. Business-hours tiers are available for non-critical sites. We’re also positioned to provide local hands across Australia, Fiji, PNG and the Solomon Islands when on-site work is needed.
