• Why not a traditional VPN?
• How it works
• The components
  • Cloud Command Center — the control plane
  • The edge — where access is enforced
  • The app — the endpoint
    • Clientless access

SonicWall Cloud Secure Edge (CSE) is a zero-trust access platform that gives your users fast, secure access to private applications, internal networks, and the internet — without a traditional VPN. Every connection is authenticated by user identity and checked against device trust before access is granted, and that check is re-evaluated on an ongoing basis rather than only at login.

Why not a traditional VPN?

A legacy VPN places a device onto the corporate network and then trusts it broadly for the length of the session. That is slow — traffic is backhauled to a central concentrator — and risky, because a single compromised device gains wide network access.

CSE takes the opposite approach. It grants access to individual resources, per request, and only when both the user and the device meet your policy. Resources are never exposed directly to the internet, and access follows the user and the device rather than the network.

How it works

The diagram below shows how the CSE components work together to deliver zero-trust access under centrally managed policy.

At a high level, a single access request flows like this:

1. A user opens the CSE app (or, for clientless access, a browser). The app registers the device and continuously evaluates its security posture, producing a Trust Level.
2. When the user requests a resource, the CSE edge brokers the connection. The edge sits between the user and the resource, so the resource is never reachable directly from the public internet.
3. Before forwarding any traffic, the edge verifies the user’s identity through your identity provider and checks the device’s Trust Level against the access policy. Only requests that satisfy the policy are allowed through, and the evaluation is repeated on an ongoing basis.

The result: your resources stay invisible to the internet, and access decisions are based on who the user is and what state their device is in — not on which network they happen to be on.

Ready to try it? The Quick Start Guides walk you through your first deployment step by step.

The components

CSE has three parts: a control plane you manage, an edge that enforces access, and an endpoint app.

Cloud Command Center — the control plane

The Cloud Command Center is the central console where IT and security teams manage CSE. Use the web portal or the RESTful API to define and enforce user- and device-based policy, configure alerts for security events, and visualize connectivity in real time. It is delivered as a SaaS offering.

Two subcomponents are sometimes called out explicitly:

• Shield groups Access Tiers together and runs a Private PKI (Public Key Infrastructure) that distributes cryptographic identities (X.509 certificates) to clients and services in your org.
• TrustProvider is a federated authentication manager. Using OpenID Connect / OAuth workflows, it authenticates users and devices through your enterprise identity provider and issues short-lived credentials to approved users on approved devices.

The edge — where access is enforced

The edge mediates access between your users and their corporate resources. CSE supports a flexible edge deployment model: use SonicWall’s infrastructure, host your own, or both. For private resources, you deploy one of the two edge components below.

• Access Tier — an identity-aware proxy and gateway you host, typically in the DMZ of a data center or cloud environment. It has a public IP reachable from the internet (usually ports 443 for web services, 8443 for infrastructure services, and 51820 for Service Tunnels), mediates access between users and internal resources, and enforces the user’s and device’s Trust Level at connection time.
• Global Edge Network & Connector — the Global Edge Network is a set of Access Tiers that SonicWall hosts and manages for you across 25+ global regions. The Connector is a lightweight, dial-out component you deploy next to your internal services; it connects outbound only to the Global Edge Network. Traffic flows from the internet to an Access Tier in the Global Edge Network, then through the Connector to the internal service — so you expose no inbound ports.

The app — the endpoint

The app is a cross-platform client for desktop and mobile devices. It handles:

• device registration and authentication;
• device Trust Scoring (device-posture checks);
• a catalog of the internal websites, infrastructure, and Service Tunnels the user can reach; and
• Internet Threat Protection policy enforcement.

Clientless access

Where the app cannot be installed — third-party vendors and contractors, or temporary access — CSE also supports clientless access:

• user authentication with Layer 7 policies;
• device registration and compliance checks via a device certificate deployed by an endpoint manager; and
• device-posture checks and continuous evaluation for websites, through a lightweight browser extension.

---

What’s next

Read more about different client-based and client-less options that SonicWall provides.