Purpose

To view and enable SSE (SASE) features in Concerto.

Steps

Step 1 — Verify Director License

In order to view SSE tabs in Concerto, the Director needs to have a license called "cloud_security".

Step 2 — Understand Parent Tenant Limitation

If you have only 1 Tenant (Parent Tenant), SSE features will not be visible under this Tenant by design. As shown below, the Parent Tenant (Mitsubishi) does not have SSE features available. Only the SD-WAN feature will be selected by default.

Step 3 — Deploy a Sub-Tenant

Deploy a new Tenant (Sub-Tenant) and select the Parent Tenant. Only Sub-Tenants will have SSE options available.

Note:

  • a. You can add a Sub-Tenant either in Director or in Concerto. If added in Director, use the Discover option in Concerto to pull the newly created Sub-Tenant data. The Sub-Tenant created via Director will initially have only SD-WAN features. Once discovered, edit it to include SSE services. However, deployment in Concerto requires completing Steps 4, 5 and 6 first.
  • b. If deploying a Sub-Tenant with SSE services via Concerto, Steps 4, 5 and 6 must be completed first. Workaround: Deploy the Sub-Tenant with SD-WAN features enabled, complete Steps 4, 5 and 6, then edit the tenant to include SSE and discard SD-WAN if not needed, and publish.

Step 4 — Deploy a Cloud Security Gateway

Once the Sub-Tenant is deployed, add a device (Full-Mesh/Hub/Hub-Controller) with device type set to "Cloud Security" so that the device acts as an SSE gateway. As of now, the Gateway cannot be deployed directly from Concerto — use Director to deploy.

Note:

  • a. If the Gateway is deployed as Full-Mesh, it will be tagged to the Default-Region by default. You can change this in Concerto via Tenant → Deploy → Regions.
  • b. If the Gateway is deployed as Hub/HCN, the region must be added in Director first — the same information will carry over to Concerto.

Step 5 — Discover the Gateway in Concerto

Deploy the device and perform Appliance Discovery at the tenant level so that the added device gets synced to Concerto.

Note: Device deploy is mandatory. Without it, the device will not appear under "Available Regions" in Step 6.

Step 6 — Enable SSE on the Sub-Tenant

Once Steps 4 and 5 are completed, edit the tenant in Concerto to include SSE services. Fill in the required Usage Type, Tenant Product and at the Select Region, select the Gateways. Without performing Steps 4 and 5, the Gateway will not be visible in Concerto Regions. Select the Gateway and add the required address pool for the clients.

Step 7 — Verify SSE Tabs

After completing the above steps, the SSE tabs will be visible in Concerto.

Step 8 — Configure SASE on the Gateway

Add the required SASE configuration under the Gateway in Director.