Designed as one mesh, managed from one console
Vexaro Mesh, now in development, is a managed SD-WAN designed to build a full mesh between your offices, data centers and clouds and to govern it with roles and central policy. Below is the planned feature set, grouped by what each part does for your network.
The network data plane
How traffic is designed to move: a direct, encrypted full mesh between sites that takes the shortest path.
Full-mesh routing
Every site is designed to hold a direct tunnel to every other site, so traffic takes the shortest path with no extra hops, rather than hairpinning through a single concentrator.
Modern encryption on every tunnel
Every tunnel between sites is planned to be protected with modern cryptography.
Governance & access
Who can reach what. Zero trust by design: every node and session is to be authenticated, and access granted by role from one place.
Zero-trust posture
Being on the network is designed to grant no implicit trust: every node and every session is to be authenticated and checked against policy before it connects.
Roles & access policies
Access is planned by department and site from one console, so people and services reach only what their role allows.
SSO / SAML
Planned SAML single sign-on with your identity provider, so admins and operators sign in with corporate identity and offboarding takes effect at once.
Operations & observability
Run the network like code and see how it is doing. The plan includes structured logs you can export to your SIEM, an API for automation and live tunnel health.
Logs, audit & SIEM export
Who connected and when is to be recorded for audit, with the log stream exportable to your SIEM for retention and alerting.
API & infrastructure as code
Sites and policy are planned to be defined through the API, so a new region or branch can be provisioned from your own pipelines, not by hand.
Observability
A planned live view of tunnel health, latency and packet loss, with alerts when a link degrades.
Deployment, your way
Cloud, self-hosted or hybrid, by design. The gateway is planned as software, the controller can live in your own perimeter, and peers are designed to connect through NAT without a public address.
Self-hosted controller
Planned for Enterprise: the controller and keys running inside your own perimeter, so routing, keys and access logs stay within your walls.
Cloud, self-hosted or hybrid
Designed to run against the cloud console, a controller in your perimeter, or both at once, so one network can mix cloud-managed and self-hosted sites.
Software gateways
Each site is planned to run a lightweight gateway as a VM or container on hardware you already have or in the cloud. There is no dedicated appliance to buy or rack.
NAT traversal, relay as fallback
Peers behind NAT are designed to connect directly wherever the network allows, with no port forwarding or public addresses, and through a relay when it doesn't.
What will make it different
Beyond the feature list, four things are planned to set the model apart.
Planned pricing per connected site or gateway, not per user or per device: $49 per site for up to five sites and $39 per site on the unlimited plan. Cost would follow locations, not headcount or endpoint count.
Sites and gateways as the unit of the network: gateways at offices, data centers and clouds are designed to build the mesh themselves, rather than an overlay assembled device by device.
Direct first: peers are designed to connect directly wherever the network allows, with a relay used only when it doesn't.
A self-hosted controller planned for Enterprise: the controller, keys and logs inside your own perimeter, not just the data plane.
These describe the Vexaro Mesh design. Vexaro Mesh is in development; plans, features and pricing may change before release.
Go deeper
See how the planned feature set maps to a specific job, or to a category you may already be evaluating.