SASE Architecture: Design and Deployment
SASE (Secure Access Service Edge) is the converged SD-WAN and cloud security framework introduced by Gartner in 2019. It combines ZTNA, SWG, CASB, FWaaS, and DNS Security in a single cloud platform. Adoption accelerated after COVID due to the widespread shift to remote work. 2026 SASE architecture guide.
SASE Components
- SD-WAN: intelligent site-to-cloud and site-to-site connectivity
- ZTNA (Zero Trust Network Access): access to private applications
- SWG (Secure Web Gateway): outbound web proxy, URL filtering, and AV
- CASB (Cloud Access Security Broker): SaaS visibility and control
- FWaaS (Firewall-as-a-Service): Internet traffic inspection
- DNS Security: secure DNS resolution, such as Cisco Umbrella
- DLP (Data Loss Prevention): prevention of data exfiltration
- RBI (Remote Browser Isolation): isolation of risky traffic
SSE vs. SASE
Since 2021, Gartner has distinguished between:
- SSE (Security Service Edge): ZTNA + SWG + CASB + FWaaS (security only)
- SASE = SSE + SD-WAN (with added connectivity)
- For organizations with an existing SD-WAN: deploy SSE only
POP-Based Architecture
SASE is cloud-native and uses global POPs (Points of Presence):
- User → nearest POP (<20ms)
- Traffic inspection within the POP (all SASE services)
- Egress to the Internet, SaaS, and private applications
- Typical footprint: 100-200 POPs worldwide per vendor
Leading Vendors in 2026
- Zscaler: pure-play SSE leader, 150+ POPs, excellent SLA
- Palo Alto Prisma Access: integrated SSE + SD-WAN (CloudGenix → Prisma)
- Netskope: established CASB leader with a comprehensive SSE offering
- Cato Networks: cloud-native, single-pass SASE
- Cisco Secure Access (Umbrella SIG + Duo + SD-WAN): Cisco integration
- Fortinet SASE: FortiSASE delivered through the FortiGate VM cloud platform
- Cloudflare One: SSE + ZTNA + SWG delivered over a global anycast network
- Versa Networks: SASE with strong SD-WAN capabilities
Sizing and Costs
- Basic SSE: €8-15 excluding tax/user/month
- Complete SASE (SSE + SD-WAN): €20-35 excluding tax/user/month
- SASE for an organization with 500 users: ~€15,000 excluding tax/month = €180,000 excluding tax/year
- 3-year TCO vs. a traditional architecture (FW + SWG + VPN): often 30% lower
Phased Deployment
Phase 1: DNS + SWG (2-3 months)
Migrate corporate Internet DNS to the SASE provider. Add an SWG browser proxy. A quick win with minimal disruption.
Phase 2: ZTNA (3-6 months)
Migrate internal applications from VPN to ZTNA. See the dedicated ZTNA guide.
Phase 3: CASB + DLP (3-6 months)
Gain visibility into M365, Google Workspace, and Salesforce. Apply DLP rules, such as blocking credit card data uploads to Dropbox.
Phase 4: FWaaS + SD-WAN (6-12 months)
Replace site firewalls and MPLS with SASE SD-WAN connectivity to POPs.
Selection Criteria
- Number and location of POPs relative to users
- ZTNA maturity (agent-based vs. agentless)
- IdP integration (Azure AD, Okta)
- Reporting and SIEM integration
- TCO and vendor consolidation
- Support maturity in France/Europe (French-speaking support, Paris/Marseille POPs)
Order from OPTINOC
OPTINOC provides SASE assessments, vendor selection, and turnkey deployment. Fortinet FortiSASE, Cisco, and Palo Alto Prisma. Quotes for SMBs and large enterprises within 48h.