In short
SASE architecture puts the security checks in the provider's cloud: users and SD-WAN sites connect to the nearest point of presence, a policy engine checks identity and device, then web, SaaS and private app traffic is inspected and forwarded. Platforms are licensed by component and edition, for example Cisco's Essentials and Advantage packages.
Get a quote for SASE architecture
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
SASE architecture diagram
The diagram below reads top to bottom: where traffic starts, where it is checked and where it ends up.
- Users and sites: staff on managed or personal devices run an agent or use a browser; offices, shops and schools connect through an SD-WAN edge.
- Tunnels and connections: agents and SD-WAN edges build encrypted tunnels to the provider; some web traffic can also be forwarded by proxy settings.
- Point of presence (PoP): the provider's nearest cloud location receives the traffic.
- Policy engine: checks the user's identity (through your identity provider and MFA), the device's health and the request against your rules.
- Inspection services: secure web gateway, CASB, firewall as a service, DLP and DNS-layer security act on the traffic.
- Applications: the internet and SaaS apps, or your private apps reached through connectors in your data centre or cloud.
- Console and logs: one place to set policy and see every decision, with export to a SIEM.
| Layer | What sits there | Who manages it |
|---|---|---|
| Edge (user or site) | Agent, browser, SD-WAN appliance or virtual edge | You or your provider, configured from the SASE console |
| Transport | Encrypted tunnels, proxy forwarding, broadband, leased line (opens in a new tab) or mobile links | SD-WAN policy plus your connectivity suppliers |
| Cloud (PoPs) | Policy engine and inspection services | The SASE vendor runs it; you set the policy |
| Applications | Web, SaaS, private apps and connectors | Your IT team and app owners |
| Management | Console, reporting, APIs and log export | You or a managed service provider |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
SASE components and what each inspects
| Component | What it inspects or controls | More detail |
|---|---|---|
| SD-WAN | Which link and path each site's application traffic takes; failover between links | SASE vs SD-WAN |
| Secure web gateway (SWG) | Web requests: URL category, reputation, downloads and, with decryption, page content | Secure web gateway (opens in a new tab) on Cloud Security |
| CASB | SaaS and AI app use inline, and data at rest through API connections | CASB (opens in a new tab) on Cloud Security |
| ZTNA | Each request to a private app, checked against identity, device and context | How ZTNA works (opens in a new tab) on ZTNA.org.uk |
| Firewall as a service (FWaaS) | Network traffic by port, protocol and application, often with intrusion prevention | SASE vs firewall |
| Data loss prevention (DLP) | Sensitive content leaving through web, SaaS, AI tools and private apps | Included by tier on most platforms |
| DNS-layer security | Domain lookups, blocking known-bad destinations before a connection is made | DNS-layer security (opens in a new tab) on DNS Security |
| Remote browser isolation or enterprise browser | Risky websites rendered away from the device, or controls built into a managed browser | Optional on most platforms |
| Digital experience monitoring (DEM) | Device, network path and app performance, for troubleshooting | Included by tier on some platforms |
Vendors group these differently. Cisco's Secure Access data sheet (opens in a new tab) lists ZTNA, SWG, CASB and FWaaS as the core components, plus VPN as a service, DLP, digital experience monitoring and remote browser isolation. HPE lists (opens in a new tab) ZTNA, SWG, CASB, FWaaS and DEM for HPE Networking (opens in a new tab) Security Service Edge (SSE), formerly HPE Aruba Networking. Check Point adds SaaS security with API-based scanning, GenAI security and an enterprise browser.
Single-pass or chained inspection
Inside the cloud, there are two broad ways to run the inspection services.
- Single-pass: traffic is decrypted once and every engine (web filtering, threat prevention, DLP, firewall rules) works on it in the same pass. Barracuda lists a single pass architecture (opens in a new tab) among SecureEdge's security features.
- Chained: traffic passes through separate services or engines in sequence, sometimes in different locations or from different vendors, for example when a Security Service Edge (SSE) from one supplier is joined to SD-WAN or browser isolation from another.
Single-pass designs aim to cut latency and keep one policy model. Chained designs can let you keep a component you already own. Neither label tells you everything, so the questions to ask a vendor are: where is traffic decrypted, how many times, and is policy written once or in several consoles?
Is SASE architecture the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Where identity and device posture plug in
Identity is the main control in any SASE framework. The policy engine needs three kinds of signal:
- Who the user is: from your identity provider, usually over SAML, with MFA. Cisco's data sheet lists SAML identity providers and Cisco Duo among Secure Access integrations.
- What the device is and how healthy it is: managed or personal, patched, encrypted, running endpoint protection. HPE says its platform covers both managed and BYOD devices.
- How the user is behaving: the NCSC notes that user risk scores (opens in a new tab), based on factors such as impossible travel, are "often provided by an IdP or Secure Access Service Edge (SASE) platform".
The NCSC also points out that device compliance checks "may not operate in real time and can lag behind changes made on the device", so posture rules should be one signal among several, not the only gate.
How traffic reaches the platform
| Method | Typical use | Example from vendor material |
|---|---|---|
| Agent on the device | Remote and hybrid staff, all traffic types | Cisco Secure Client (opens in a new tab); Barracuda SecureEdge Access Agent; Exium's single endpoint agent |
| Clientless browser access | Contractors and personal devices reaching web apps | Cisco lists browser-based access including SSH and RDP; HPE lists agentless ZTNA |
| IPsec tunnels from sites | Offices and data centres | Cisco forwards web traffic by IPsec tunnels, PAC files and proxy chaining |
| Automated SD-WAN tunnels | Branches on the vendor's own SD-WAN | Cisco automates tunnels from Catalyst SD-WAN and Meraki Auto VPN |
| App connectors | Private apps in a data centre or cloud | Cisco Resource Connectors; outbound-only links so apps are not exposed |
Connectors matter for the NCSC's third anti-pattern, exposing private applications to the internet (opens in a new tab): its advice is that services should not need public IP addresses.
SASE network, SASE fabric and other framework wording
You will meet several labels for the same idea.
- SASE network usually means the provider's points of presence and the links between them and your sites. Check Point describes its Private Access as using a "full mesh global private backbone".
- SASE fabric is a term you may see for the joined-up set of edges, tunnels, PoPs and policy. It is descriptive, not a standard.
- SASE framework usually means the list of components above and how they relate. There is no single formal standard, which is why platforms differ in what they include.
When comparing, map each vendor's names back to the component table rather than relying on the label.
How we help design a SASE architecture
We can map your users, sites, links, identity provider and applications onto a target SASE architecture, show which components you already have, and recommend a single-vendor or dual-vendor design from the platforms we supply. Where a trial is available, we can set up a pilot before you commit. Scope is confirmed at quote. Contact us to talk it through.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is SASE architecture?
The design that delivers networking and security together from the cloud: users and sites connect to a provider's points of presence, a policy engine checks identity and device, and inspection services handle web, SaaS and private app traffic before it reaches the application.
What are the components of SASE?
SD-WAN for sites, plus the Security Service Edge (SSE): secure web gateway, CASB, ZTNA and usually firewall as a service, with DLP, DNS-layer security, browser isolation and experience monitoring depending on the platform and tier.
What is the SASE framework?
It is the set of components a SASE platform is expected to provide and how they share one policy. It is a description used across the industry rather than a formal standard, so check what each vendor includes.
What is a SASE network?
The provider's cloud locations (points of presence), the backbone between them and the tunnels from your sites and users. Your traffic enters the SASE network at the nearest location and is inspected there.
Does SASE architecture need hardware?
Remote users need only an agent or a browser. Sites usually need an SD-WAN appliance or virtual edge, or an existing router or firewall that can build tunnels to the platform.
Still have a question about SASE architecture?
Ask us and a member of our team will get back to you.