Overview of SASE Framework

Summary

This document provides an in-depth overview of Secure Access Service Edge (SASE), a networking and security framework introduced by Gartner and delivered as a unified, cloud-native service.
The guide outlines SASE's core characteristics, its main architectural components, the problems it solves, and its advantages compared to traditional point solutions.
Cato Networks’ implementation of SASE is featured, emphasizing the convergence of SD-WAN, global cloud networking, and security features into a single platform.
The resource includes a comparison between legacy solutions and SASE and addresses frequently asked questions on SASE’s use cases, benefits, and differentiators.

SASE (Secure Access Service Edge) is a framework that converges SD-WAN, cloud networking, and security services (including FWaaS, CASB, DLP, SWG, and ZTNA) into a unified, cloud-native service.
Its purpose is to reduce complexity and fragmented infrastructure, lower risk of breaches, enable secure remote work, and improve access to global applications.
SASE architectures have four main characteristics:
- Identity-driven access, with risk-based policies considering user, device, data, and context.
- Cloud-native design, providing elasticity, self-maintenance, and rapid adaptation to business needs.
- Support for all edges, extending consistent security and optimization to any user or device, anywhere.
- Global distribution, ensuring low-latency networking and security worldwide.
SASE connects and secures physical, cloud, and mobile enterprise resources regardless of location.

Software-Defined WAN (SD-WAN): Manages and optimizes WAN traffic, supports global connectivity and remote access, and integrates security.
Secure Web Gateway (SWG): Protects users from malware, phishing, and web threats across all locations without added latency.
Firewall as a Service (FWaaS): Delivers scalable, elastic network security stacks wherever needed.
Zero Trust Network Access (ZTNA): Dynamically secures application access based on user identity, device posture, and session context, with continuous risk inspection.
Cloud Access Security Broker (CASB): Monitors SaaS usage, including unsanctioned apps, and applies granular access policies.
Global Cloud Network: Optimizes routing and access for cloud and on-premises applications and latency-sensitive traffic.
Unified Management: Enables single-pane management of all networking and security functions, reducing complexity.

Agility: Fast and easy deployment with cloud-native design; zero-touch provisioning for immediate onboarding worldwide.
Security: Unified policies and full visibility/control over WAN, Internet, and Cloud traffic; consistent policy application across the enterprise.
Service Lifecycle: Autonomous management, continuous threat posture maintenance, and resilience to infrastructure issues.
Cost Effectiveness: Simplifies management, reduces the need for multiple point products, and lowers operational costs.

Service Agility: SASE delivers quick, easy provisioning and deployment, while legacy solutions are slow and require integration of multiple products.
Visibility & Control: SASE offers unified oversight and policy management, improving collaboration and troubleshooting, compared to legacy silos and fragmented control.
Infrastructure Management: Cato SASE Cloud offloads maintenance and updates, letting IT teams focus on business needs, unlike the manual workload in legacy setups.
Cost: SASE’s built-in capabilities and cloud delivery model reduce the need for costly, complex integrations and ongoing maintenance seen with legacy products.

SASE supports incremental WAN transformation projects, enabling organizations to address immediate needs (like SD-WAN, global connectivity, security) while building a platform for future requirements.
It enables replacement of MPLS, increases bandwidth, secures direct Internet access, and simplifies management.

What is SASE used for? For delivering converged network and security services from a global cloud, reducing cost and complexity of point solutions, and improving WAN/cloud connectivity.
How is SASE different from point solutions? SASE replaces multiple, separately managed products (SD-WAN, NGFW, SWG, VPN) with a cloud-delivered, unified architecture.
Difference between SD-WAN and SASE: SD-WAN is a component that connects branches/data centers; SASE adds security, cloud, and mobile support for complete WAN transformation.
Why is SASE important? It provides agile, scalable, cost-effective network and security management for all users and locations.
Is SASE more secure? Yes, SASE is end-to-end encrypted and offers integrated, global security features like firewall, URL filtering, anti-malware, and IPS.
What is not SASE? Service chaining or bundled point solutions are not SASE; true SASE is cloud-native, identity-driven, and converged across all edges.