Secured SD-WAN for Indian enterprises, run from your data centre or ours
An encrypted overlay across MPLS, ILL, broadband and 4G/5G that steers each application to the best path and fails over in under a second. Run it in your data centre or ours.
- <1 s
- Failover between links
- 4 link types
- MPLS, ILL, broadband, 4G/5G
- DC + DR
- Self-hosted controller, or hosted in India
In short. Nexapp Controller is a secured SD-WAN platform from an Indian OEM. It builds an encrypted overlay across MPLS, ILL, broadband and 4G/5G links, steers each application to the best path, and fails over in under a second. Run the controller in your own DC and DR, or use Nexapp-hosted in India. Every tunnel uses hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203).
Key facts
- Scale
- 75,000+ devices deployed; 400+ enterprise and banking customers; in production since 2014
- Flagship proof
- 2,500 ATM sites moved from VSAT to dual-LTE with day-1 zero-touch provisioning
- Hosting
- Controller in your DC/DR (with HA and DC–DR replication), or Nexapp-hosted in India
- Edge form factors
- Nexapp appliances and x86 bare metal, virtual machines on KVM, Hyper-V and VirtualBox, AWS, Azure and Google Cloud, and data-centre hubs, all on NexappOS
- Failover
- Sub-second, driven by Gold/Silver/Bronze SLA probes
- Encryption
- Hybrid classical + ML-KEM key exchange and ML-DSA authentication on every IKEv2 tunnel
- Operations
- 24×7 NOC in Pune; one SLA across hardware, firmware and platform
- Make in India
- Class-I local supplier under the PPP-MII Order; local-content certificate with each bid
- Earlier name
- Instaroute SD-WAN and Instaroute SD-Branch
Nexapp Controller
One console for every site, link and device
Fleet health, uplink status, per-link and per-application traffic, and firmware versions across every branch, in the same Nexapp Controller that builds your SD-WAN fabric.
Home / Overview
Dashboard
186 / 200
Devices online
372 / 400
Uplinks up
Devices by site
Device health
- Online186
- Problem6
- Offline8
Models
- IRX100-5G82
- IRX60064
- IRX150038
- Other16
Firmware versions
- NexappOS 10.0.83124
- NexappOS 10.0.8251
- NexappOS 10.0.7919
- Other6
Illustration of the Nexapp Controller with sample data.
- Fleet health at a glanceDevices online, with problem and offline counts, and every site on a map.
- Every uplink, measuredUplinks up and down, and a per-WAN-link breakdown across MPLS, ILL, broadband, 4G and 5G.
- Application insightTop sites, applications and categories by traffic, over wired, cellular and Wi-Fi.
- Firmware and modelsFirmware versions and device models across the estate, in the same console.
Keep MPLS. Add 4G, broadband and control.
Most Indian branch networks already run a mix of MPLS, ILL, broadband, RF, VSAT and 4G. Nexapp Controller does not ask you to rip any of it out. It treats every link as transport, bonds them into one secured overlay, and decides per application which path to use. The fabric uses standards-based IPsec, BGP and OSPF, so it works alongside your existing MPLS and data-centre routing. Sites migrate one at a time in a phased rollout, with no flag day.
The result for the business:
- Higher uptime. Probes measure loss, latency, jitter and MOS on every link, and move traffic in under a second when a link degrades.
- Lower WAN cost. Add broadband and 4G/5G capacity alongside MPLS, and send internet-bound SaaS traffic out locally instead of backhauling it.
- Faster rollout. Zero-touch provisioning with serial admission means a branch comes up when the box is plugged in.
- Evidence for auditors. Logs, reports, config history and a cryptographic bill of materials (CBOM) help you meet CERT-In and RBI obligations.
How it works
- Design the fabric. A six-step wizard builds hub-and-spoke, full-mesh (ADVPN) or site-to-site topologies.
- Admit the devices. Edges are admitted by serial number and provisioned zero-touch.
- Set the policy once. Define SLA tiers, QoS classes, application steering and security profiles centrally.
- Steer by application. DPI identifies the application; the controller sends it to the overlay, a local internet breakout, a gateway, or drops it.
- Operate and audit. Config snapshots with diff and rollback, mass firmware upgrade, 25+ reports and a multi-tenant REST API.
Security on the edge, not bolted on
Each Nexapp edge carries IPS, gateway antivirus, web filtering, anti-spam and InstaShield IP, which blocks traffic from IP addresses with a bad reputation. Administrator access uses TACACS+ or RADIUS. When you are ready, the same edge extends to NGFW policy and SSE/ZTNA without a new vendor. Start with one router. Grow to full SASE.
Quantum-safe tunnels, end to end
Attackers can record encrypted WAN traffic today and decrypt it once quantum computers mature ("harvest now, decrypt later"). Nexapp protects every layer against that risk:
- Hybrid classical + ML-KEM key exchange (NIST FIPS 203) on SD-WAN IPsec tunnels and the management plane.
- ML-DSA (FIPS 204) peer authentication.
- Post-quantum-signed firmware and configuration.
- Post-quantum TLS 1.3 (X25519MLKEM768) on the console and API.
- Crypto-agility by policy, plus a CBOM for your cryptography inventory.
Post-quantum mode is on by default. See Post-quantum cryptography.
Tender-ready specification
| Area | Nexapp Controller |
|---|---|
| Topologies | Hub-and-spoke, full-mesh (ADVPN), site-to-site; six-step fabric wizard |
| Transports | Every available WAN transport at the site, including MPLS, ILL, broadband and 4G/5G (Instaroute) |
| Session modes | Auto, weighted, SLA, duplicate, per-packet |
| Loss protection | Forward error correction and packet duplication; tunnel MTU 576–9000 |
| Encryption | IPsec IKEv2 with hybrid classical + ML-KEM (FIPS 203) key exchange; ML-DSA (FIPS 204) authentication; AES-256-GCM, AES-128-GCM or ChaCha20-Poly1305; IKE and ESP cipher and DH group configurable per topology |
| Management-plane crypto | Post-quantum TLS 1.3 (X25519MLKEM768) on console and API |
| Routing | BGP (with route reflector), OSPF, IS-IS, static routes, VRF |
| IPv6 | Dual-stack IPv4/IPv6 on Instaroute edges (NexappOS); |
| QoS | Five traffic classes; application-aware steering by DPI (overlay, internet breakout, gateway, drop) |
| SLA monitoring | Gold, Silver, Bronze tiers; ICMP, TCP and HTTP probes; loss, latency, jitter, MOS; sub-second failover |
| Security | IPS, gateway antivirus, web filtering, anti-spam, InstaShield IP reputation blocking |
| High availability | Device HA (VRRP), controller HA, DC–DR replication |
| Access control | TACACS+ with per-command authorisation and accounting, RADIUS; role- and group-based permissions; TOTP two-factor sign-in |
| Provisioning | Zero-touch with serial admission; config snapshots, diff and rollback; mass firmware upgrade |
| Hosting | Controller on-premises in your DC and DR, or Nexapp-hosted in India |
| Logs and retention | Access, activity, device, firmware and audit logs with configurable retention; events exported by syslog, webhook or email; logs stay in your DC with an on-premises controller, or in India when Nexapp-hosted; |
| Reporting | 25+ reports |
| API | Multi-tenant REST API with OpenAPI specification |
| Addressing and PKI | Built-in IPAM and PKI |
| Licensing | On request |
| Lifecycle | End-of-life policy: coming soon |
| Product certifications | IEC 62443, TEC MTCTE, CE, RoHS. TEC MTCTE certificate 244903206 (valid to March 2035) covers Instaroute IR1100, ODU and IRX100-5G routers, not the IRX100-5Gv2 or IRX400 to IRX5000 edges |
| Local content | On request |
| Uptime SLA bands | On request |
Proof
- 2,500 ATM sites moved from VSAT to dual-LTE with day-1 zero-touch provisioning: more than double the bandwidth, direct cloud connectivity and higher uptime. Read the ATM migration story.
- Trusted by customers including Wipro, Jio, BSNL, NABARD, Aditya Birla Group, India1 ATM, Siemens Gamesa and Nayara Energy.
- Gartner Magic Quadrant, Notable Vendor 2021, APAC (WAN Edge Infrastructure).
- ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018 certified operations.
Related guides
Frequently asked questions
Is Nexapp Controller the same product as Instaroute SD-WAN?
Yes. Nexapp's SD-WAN was earlier sold as Instaroute SD-WAN and Instaroute SD-Branch, the name still shown on Gartner Peer Insights and some marketplace listings.
It is now Nexapp Controller (SD-WAN Enterprise), running on NexappOS. The Instaroute name continues for Nexapp's 4G and 5G routers.
Can I keep MPLS and add 4G or broadband?
Yes. Nexapp Controller is transport-agnostic and builds one encrypted overlay across MPLS, ILL, broadband and 4G/5G.
Applications are steered per link based on live SLA measurements, so MPLS stays in use where it earns its cost.
Can the controller run on-premises in our DC and DR?
Yes. You can deploy the controller in your own DC and DR with controller HA and DC–DR replication, or choose Nexapp-hosted in India.
Either way, management stays under Indian jurisdiction.
Can the SD-WAN edge run in AWS, Azure or Google Cloud?
Yes. NexappOS runs as a virtual edge in AWS, Azure and Google Cloud, as a virtual machine on KVM, Hyper-V or VirtualBox, on x86 bare metal and as the hub in your data centre.
Cloud workloads join the same encrypted SD-WAN as your branches, with the same policy and one console. See NexappOS form factors.
How fast is failover?
SLA probes (ICMP, TCP, HTTP) measure loss, latency, jitter and MOS continuously, and traffic moves in under a second when a link breaches its Gold, Silver or Bronze threshold.
Duplicate and per-packet session modes protect the most critical flows.
Do logs stay in India for 180 days?
CERT-In requires ICT logs to be kept for 180 days within India.
With an on-premises controller, logs stay in your data centre; with Nexapp-hosted, they are held in India. This helps you meet the obligation; the obligation itself stays with your organisation.
Is licensing tied to full box throughput from day one?
. Ask us for a licence schedule in your RFP's format.
How do you migrate branches without downtime?
Sites move in phases while existing links keep carrying traffic.
Zero-touch provisioning brings each edge up on arrival, and config snapshots allow rollback at any point.
Is the SD-WAN quantum-safe?
Every Nexapp tunnel uses hybrid classical + ML-KEM key exchange (NIST FIPS 203) with ML-DSA authentication, which protects against harvest-now, decrypt-later attacks.
Post-quantum mode is on by default.
Can it grow into SASE later?
Yes. The same edge and NexappOS firmware extend to NGFW and SSE/ZTNA from the same vendor, without replacing branch hardware.
See your WAN on one console, with a tender-ready spec sheet to match.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.