The Nexapp SASE platform: one vendor from edge to cloud
Secured SD-WAN, NGFW, SSE/ZTNA and Instaroute™ 4G/5G routers on one operating system, from one vendor. Start with one router and add security later without replacing anything.
Key facts
- Components
- Nexapp Controller (SD-WAN Enterprise), NGFW security suite, Nexapp SSE (ZTNA, SWG, CASB, DLP, FWaaS, sandbox), Instaroute routers, Instaroute SDWAN Lite 2.0, Enterprise Wi-Fi and InstaWave, and NexParth AI.
- One operating system
- NexappOS runs on every edge device, from Instaroute Lite Series 4G routers to Enterprise X Series SD-WAN edges, and on x86 bare metal, virtual machines (KVM, Hyper-V and VirtualBox), AWS, Azure, Google Cloud and data-centre hubs (form factors).
- Deployment
- Nexapp-hosted in India, or self-hosted with controller HA and DC–DR replication.
- Scale
- 75,000+ devices deployed; Instaroute SDWAN Lite 2.0 manages up to 100,000 devices per deployment.
- Post-quantum
- Hybrid ML-KEM key exchange, ML-DSA authentication, post-quantum-signed firmware and post-quantum TLS 1.3 across the platform.
- Support
- 24×7 NOC in Pune; one SLA across hardware, firmware and platform.
What SASE means, and where SD-WAN and SSE fit
SASE (secure access service edge) joins networking and security into one service. It has two halves:
- SD-WAN connects your sites. It picks the best link for each application and keeps your branches online when a link fails.
- SSE (security service edge) secures your users and apps. It includes ZTNA (zero-trust network access), a secure web gateway, CASB and DLP.
Add a next-generation firewall (NGFW) at the edge and you have the full picture. All three come from one vendor, so you can buy one half now and add the other later.
Platform architecture
| Layer | Component | What it does |
|---|---|---|
| Edge devices | Instaroute Lite Series and Enterprise X Series routers, Enterprise Wi-Fi and InstaWave | Connect your sites over 4G, 5G, broadband or MPLS |
| Firmware | NexappOS | Routing, VPN, zone firewall and industrial protocols on every device |
| Network | Nexapp Controller (SD-WAN Enterprise) | Fabrics, SLA steering, DPI, QoS and routing |
| Edge security | NGFW suite | IPS, gateway antivirus, web filtering, anti-spam, InstaShield IP |
| User and app security | Nexapp SSE | ZTNA, SWG, CASB, DLP, FWaaS and sandbox under one policy engine |
| Router management | Instaroute SDWAN Lite 2.0 | Zero-touch, firmware rollout, alarms and MSP console for large router fleets |
| Operations | NexParth AI | Answers from live fleet data; acts after your approval |
You get a single management application and a documented platform API. See all platform capabilities →
Start with SD-WAN. Add SASE when you choose.
You may need SD-WAN today and SASE only later. Indian bank RFPs often ask for a solution that is SD-WAN ready from day one and can support SASE "as and when opted". The platform is built for that path:
- Start with Instaroute routers on Instaroute SDWAN Lite 2.0, or SD-WAN branches on the Controller.
- Add NGFW services on the same edge devices.
- Add SSE/ZTNA for your users and cloud apps.
At each step, you keep the same devices, the same NexappOS and the same post-quantum encryption.
Deployment: India-hosted or in your data centre
- Nexapp-hosted in India: we run the controller and management platform for you.
- Self-hosted: run the Controller in your own DC, with controller HA and DC–DR replication, as many bank RFPs require.
- Logs: logs stay in India, which supports CERT-In's 180-day log retention obligation. You set retention; SDWAN Lite 2.0 keeps alarm history for 180 days by default.
- Access control: TACACS+ and RADIUS for your administrators; multi-tenant REST API with OpenAPI.
Security built into every layer
One missed layer is all an attacker needs. Here is what protects each one.
- Network: IPsec IKEv2 tunnels with hybrid post-quantum key exchange.
- Edge: IPS, gateway antivirus, web filtering, anti-spam and reputation blocking.
- Users: ZTNA checks identity and device posture before granting access to each app. Passkey sign-in.
- Data: CASB and DLP control what leaves your organisation.
- Management: post-quantum TLS 1.3 on consoles and APIs; signed firmware and configuration.
Outcomes
- Fewer vendors: one SLA across hardware, firmware and platform.
- Faster roll-outs: zero-touch provisioning brings your sites up on day 1.
- Higher uptime: SLA probes measure loss, latency, jitter and MOS, with sub-second failover.
- Simpler audits: 25+ reports, config snapshots with diff and rollback, and a CBOM for your cryptographic inventory.
Proof
- 75,000+ devices deployed for 400+ enterprise and banking customers across India and APAC.
- 2,500 ATM sites moved from VSAT to dual-LTE with day-1 zero-touch provisioning: more than double the bandwidth, direct cloud connectivity and higher uptime.
- Named in the Gartner Magic Quadrant for WAN Edge Infrastructure, 2021, as a Notable Vendor in APAC.
Related guides
Frequently asked questions
What is the difference between SASE and SD-WAN?
SD-WAN connects your sites and chooses the best path for each app.
SASE adds security services, such as ZTNA, web gateway, CASB and firewalling. Your sites and users are then protected under one policy. We offer both, and you can start with SD-WAN.
What is the difference between SASE and SSE?
SSE is the security half of SASE: ZTNA, SWG, CASB, DLP and FWaaS.
SASE is SSE plus SD-WAN. Nexapp SSE can protect your users on its own, or work with our SD-WAN as full SASE.
Can I start with SD-WAN and add SSE later without rip-and-replace?
Yes. Routers and SD-WAN edges keep running NexappOS; NGFW and SSE/ZTNA are added when needed.
Your encryption and management stay the same.
Can the controller run on-premises in my DC and DR?
Yes. You can self-host the Nexapp Controller with controller HA and DC–DR replication.
Or we can host it for you in India.
Where are logs stored?
With self-hosting, logs stay in your data centre.
With our hosting, the platform runs in India, and SDWAN Lite 2.0 keeps alarm history for 180 days by default.
Is the Nexapp platform quantum-safe?
Every tunnel uses hybrid post-quantum key exchange (classical plus ML-KEM, NIST FIPS 203).
You also get ML-DSA authentication, post-quantum-signed firmware and post-quantum TLS 1.3. This protects your traffic against harvest-now, decrypt-later attacks.
Who supports the platform?
Our 24×7 NOC in Pune supports you, with field operations across India.
One SLA covers hardware, firmware and platform.
See the full platform, from one router to SASE, on your own network design.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.