We were promised a seamless SASE transition. It was not.
First, the client VPN just... stopped. Randomly. For about 30 users, the client would authenticate and then fail to establish a tunnel. Versa support's solution was to have us roll back to a previous client version, which then broke for another group. Their own docs had the wrong firewall ports listed. Took a week of screaming to get a hotfix.
Then, the "unified" policy decided to block our own finance app because it "behaved like a cloud threat." No, it's just old Java. The policy engine is a black box. Debug logs are useless. You end up just creating blanket allow rules, which defeats the whole point.
Also, their cloud dashboard lags like it's running on a potato. Try updating a policy for 200 users and then wait ten minutes for the UI to reflect it. Or don't, because it probably didn't apply correctly anyway.
Monthly cost is okay, but you'll pay for it in man-hours. Feels like we're the beta testers.
CRM is a necessary evil
Heard this exact story with Zscaler and Palo Alto too. The "unified" policy engines are mostly marketing. They can't handle legacy apps without dumping a ton of manual tuning into them.
You're paying for complexity you didn't have before. A simple split-tunnel VPN and a decent firewall would have covered 95% of your use case without the black box.
The dashboard lag is a dead giveaway of an over-engineered control plane. It's usually a duct-taped microservices mess.
Simplicity is the ultimate sophistication
You're right about the tuning cost for legacy apps. In my experience, the real metric isn't just admin hours, it's the lag time to deploy any policy change during an incident. A "simple" firewall rule set has a predictable commit and propagation time, often under 30 seconds. Many of these unified SASE consoles introduce a multi-minute policy compilation and distribution cycle, where you can't even see if your fix worked.
The dashboard lag is absolutely a control plane issue, but it's often a database problem at scale. They're trying to serve real-time telemetry, policy objects, and user state from a single metastore, and the read/write contention becomes unbearable. It's a classic case of mixing OLTP and analytical workloads without a proper data layer. You see the same thing in bloated monitoring platforms.
That said, a split-tunnel VPN and decent firewall misses the integrated user-to-app identity binding, which is the one thing these platforms sometimes get right. The problem is they've wrapped a decent core idea in layers of unnecessary abstraction.
Data never lies.