Direct encrypted OmniVPN tunnels
OmniVPN creates encrypted direct connections between sites and remote users without routing through a third-party overlay network. A pilot covers topology and required appliances.
← Platform
XCITIUM / SASE
Direct connections. Controlled access.
OmniVPN, SD-WAN and ZTNA connect users and sites. Data and management traffic follow separate paths.
Inside the architecture
Explore the two network planes
01Data traffic
+
Encrypted OmniVPN tunnels connect users and sites directly.
OmniVPN · SD-WAN02Management
+
Policies, visibility and reporting are centralized in the Xcitium cloud console.
Xcitium Console03Access policy
+
ZTNA evaluates user roles, location and schedules; IPS and DNS filtering operate locally.
ZTNA · IPS · DNSXCITIUM / SASENETWORK ARCHITECTURE
01 / Management planeXcitium cloud consolePolicy · visibility · reporting
MANAGEMENT / DATA BOUNDARYOmniVPN / SD-WANDirect encrypted connection
02Remote user
03Branch network
04Data centre
ZTNAZTNA access decision
RoleLocationSchedule
Local enforcement: IPS / DNS filtering01 / OmniVPN · SD-WANData path
OmniVPN forms direct encrypted tunnels between users and sites. SD-WAN supports the connection.
02 / Xcitium ConsoleControl path
Policy, visibility and reporting meet in the Xcitium cloud console; data connections remain separate.
03 / ZTNA · IPS · DNSAccess policy
ZTNA evaluates role, location and schedule. IPS and DNS filtering apply locally.
SD-WAN across varied connection types
CGNAT, multi-NAT, cellular, satellite and private IP connections work without upstream-router or ISP setting changes. A pilot covers existing routes, bandwidth and topology.
ZTNA based on role and context
Access policies can use user role, location and schedule for remote and office users, including BYOD. Define how policies map to identity sources, device trust and exceptions.
Local threat prevention at the edge
Appliance-based IPS, DNS and IP filtering, CountryBlock and AdBlock provide network-level inspection and blocking. Configure policy categories, logs and change approvals under organizational governance.
Separate management and data planes
In standard Xcitium SASE, policies and reporting use the Xcitium cloud console while data packets stay within the customer network. Management metadata, identity and connectivity are part of the deployment design.
PrivateSASE deployment option
PrivateSASE places the complete SASE stack in a customer private cloud or on-premises data centre and is designed for isolation from the public internet. Internet, licensing, updates, identity and support dependencies follow the deployment model.
Compare approaches
Standard Xcitium SASE and PrivateSASE
| Consideration | Standard Xcitium SASE | Xcitium PrivateSASE™ |
|---|---|---|
| Deployment | Distributed appliances run at customer sites and network edges. | The complete stack is deployed in the customer private cloud or on-premises data centre. |
| Management plane | The Xcitium cloud console manages policies and reporting. | Designed for isolated deployment, with management components defined by the selected design. |
| Data traffic | Data packets stay within the customer environment. | Traffic is designed to operate in the private deployment without external communication. |
| Potential fit | Organizations that accept centralized management through a cloud console. | Organizations that need the full stack in their environment and restrict external communications. |
| Confirm before selection | Management metadata, console access, appliance topology and service boundaries. | Isolation conditions, update and support path, identity, licensing and recovery model. |
Before you start
Pilot and deployment questions
SASE selection depends on management plane, external connectivity, security operations and branch change constraints as well as topology. Include these dependencies in a standard SASE or PrivateSASE pilot.
- 01
Which sites, users, apps and connection types belong in the pilot, including any CGNAT, cellular or satellite links?
- 02
For standard SASE, what management traffic and metadata use the Xcitium cloud console, and who will have console access?
- 03
If PrivateSASE is required, which external dependencies remain for updates, licensing, identity, support and recovery?
- 04
Who will approve and maintain ZTNA roles, location and schedule rules, BYOD exceptions and network filters?
Evidence for your evaluation
Xcitium SASE capabilities and management model
Xcitium SASE combines OmniVPN, varied network types, ZTNA, local IPS/DNS/IP filtering and a cloud console while data traffic stays in the customer environment.
Read morePrivateSASE deployment
PrivateSASE deploys the complete SASE stack in a customer private cloud or on-premises data centre.
Read moreBefore you decide
Questions, answered
What is Xcitium SASE?
Xcitium SASE combines OmniVPN, SD-WAN, ZTNA and local network threat prevention across distributed edges. Confirm feature scope and deployment model for the selected configuration.
How is Xcitium SASE different from traditional SASE?
Xcitium describes direct site connectivity with data traffic staying in the customer network. In the standard deployment, the management console is cloud-based, so review the management and data planes separately.
What is PrivateSASE™ and who needs it?
PrivateSASE is offered to deploy the complete SASE stack in a customer private cloud or on-premises data centre. Organizations restricting external communication should also review management, update, identity and support dependencies.
What network types are supported?
Xcitium SASE supports CGNAT, multi-NAT, cellular, satellite and private IP. A pilot covers the specific ISP, router, bandwidth and topology.
How does Zero Trust work in Xcitium SASE?
ZTNA policies can use user role, location and schedule. Each deployment defines identity sources, device trust, BYOD and policy exceptions.
Does it require extra infrastructure?
Xcitium Core Appliances may be required at site edges; the standard model is managed through the Xcitium platform. Confirm appliance count and placement, failure handling and PrivateSASE requirements against the topology.
Does it work with existing security tools?
Xcitium SASE complements endpoint and EDR with network-level ZTNA, IPS and visibility. Integration points, event sharing and policy overlap depend on the deployment environment.
Xcitium