Skip to main content
As organizations move toward cloud-native environments, the way organizations secure and connect their networks has fundamentally changed. This topic explains the differences between and , and how Megaport provides the private and high-performance backbone to integrate SSE and SASE functions into your network.

​
Understanding SSE and SASE within the Megaport network

SSE — The security component SSE is a set of cloud-delivered security services. It is designed to protect users and data regardless of where they are located.
  • Key services — , , and .
  • Goal — Secure User-to-App and App-to-App traffic.
SASE — The comprehensive architecture SASE provides a comprehensive approach for networking and security. It represents the convergence of networking () and security functions into a single, global, cloud-native service.
  • The formula — SASE = SSE + SD-WAN
  • Goal — Simplify management and improve performance by combining connectivity and security.
As a Network as a Service (NaaS) provider, Megaport plays a critical role by hosting SD-WAN and security services. By providing a secure and private underlay as well as hosting capability, Megaport enables the seamless integration of SSE and SASE features directly into your network architecture. Megaport’s role — Connectivity layer While SSE and SASE providers such as Palo Alto Networks, Cisco, and Fortinet manage the security inspection and policy, Megaport provides the private software-defined network that carries the traffic between your locations and the cloud. Megaport bypasses the inherent instability of the public internet by utilizing a private and dedicated backbone. By using Megaport, you ensure your SSE and SASE traffic doesn’t get slowed down by public internet congestion and high-jitter or high-latency hops. Network overview — SSE and SASE via the Megaport network The following network diagram illustrates how the Megaport network carries private traffic to integrate SSE and SASE functions into your network.

​
Summary of features provided by SSE and SASE

The following table summarizes SSE and SASE features.

​
Implementing SSE using Megaport services

Architectural overview Some SSE platforms, including Cloudflare, Netskope, Cato, and Palo Alto Prisma Access, integrate with Megaport by providing private connectivity to Megaport-enabled data centers and cloud on-ramps. You can also implement SSE solutions with a Megaport Virtual Edge (MVE), which hosts virtualized network functions (VNFs) such as , CASB, SGW, and ZTNA, at the edge of Megaport’s global private network. The MVE also facilitates secure access from cloud-based SSE platforms to private applications hosted in data centers and CSPs. While SASE focuses on the convergence of SD-WAN and security, an SSE-centric MVE deployment prioritizes the security stack and serves as a private on-ramp to cloud security providers. Instead of sending sensitive corporate traffic solely over the unpredictable public internet, user traffic is directed to a localized MVE. Deployment workflow
  1. Provision the MVE — Deploy an MVE instance in the metro area geographically closest to your users or branch offices to minimize latency.
  2. Appliance activation — Once the virtual appliance is active on the MVE, it is registered with your SSE vendor’s central management console (for example, Prisma Access Strata Cloud Manager, FortiSASE). This allows you to push granular security policies and identity-based access controls to the edge.
  3. Establish connectivity — To complete the path, you configure Virtual Cross Connects (VXCs) from the MVE directly to your Cloud Service Providers (CSPs) or your SSE vendor’s cloud points of presence (PoPs).
This setup creates a secure private underlay where traffic is first secured on the MVE and then transported across Megaport’s private backbone. This bypasses internet congestion, mitigates DDoS risks, and provides a more stable, predictable path for your SSE-protected data.

​
Implementing SASE using Megaport services

Architectural overview You can implement SASE SD-WAN with MVE, which hosts SD-WAN virtualized network functions (VNFs) directly on Megaport’s global private SDN. Instead of relying solely on the public internet, traffic from branch offices or remote users connects to a localized MVE. The MVE runs certified SASE or VNF appliances from partners such as Cisco, Fortinet, Palo Alto Networks, Versa, and so on, which integrate the SSE security stack with networking optimization (SD-WAN). Deployment workflow
  1. Provision the MVE — Deploy an MVE instance in the metro area geographically closest to your users or branch offices to minimize latency.
  2. Configure security policies — Once the virtual appliance is active, it will automatically register and authenticate with the vendor’s central orchestrator to incorporate SD-WAN security policies. For example, Palo Alto Panorama and Fortinet FortiManager.
  3. Establish connectivity — Configure VXCs from the MVE to CSPs such as AWS, Azure, or Google Cloud. This creates a connectivity where traffic is secured at the edge and then transported across Megaport’s private backbone, bypassing internet congestion and reducing egress costs. A 100% private underlay to key locations, such as an enterprise headquarters office or a manufacturing facility, can be created through Megaport’s private data center interconnects globally.

​
MVE vendor image deployment

The following table provides a list of documentation explaining how to deploy a host MVE for your chosen vendor. This is the first step before implementing SSE and SASE services. As Megaport continues to add new vendors, if a specific vendor is missing, check the MVE Overview section for the most up-to-date list of supported vendors. For detailed configuration steps, please consult the product documentation provided on each vendor’s website.

​
Helpful references

Last modified on August 21, 2026