SASE Solutions

Summary

emPOWER SASE is our Secure Access Service Edge capability: networking and security brought together in a cloud-delivered model designed for distributed users, locations and applications, so users get consistent, protected access to applications wherever they work. SASE capabilities form part of our Connectivity offering. The proposal and Service Order define the components, licences, integration work and charges included in your solution.

This page explains the SASE capability and related features described in our emPOWER Connectivity brochure. Confirm which network features, support arrangements and contractual commitments apply to your SASE design.

Key facts

Why SASE exists as a category

Traditional perimeter designs can route remote traffic through a central data centre for inspection. For distributed users and SaaS applications, that route can add latency or concentrate dependencies. The effect depends on routing, capacity, redundancy and the inspection design.

A cloud-delivered model answers that by moving enforcement to the edge rather than the centre. Our own description is that emPOWER SASE "brings networking and security closer together in a cloud-delivered model designed for distributed users, locations and applications", combining technologies such as SD-WAN, secure access and security policy enforcement to improve user experience while applying more consistent protection across the network.

Coordinating network and security operations can help keep policy changes and fault ownership clear. It does not remove every supplier dependency or hand-off. Agree responsibility for carriage, identity, endpoints, inspection and incident escalation in the service design.

The network underneath

Our emPOWER Connectivity brochure describes the following network capabilities. Their inclusion in a SASE solution depends on the agreed architecture:

• Fully meshed MPLS private core — traffic moves across our own network rather than the public internet
• Cisco ASR carrier-grade routing as the core routing platform
• Tier 1 carrier-agnostic — not tied to a single upstream carrier, which is what makes multi-carrier site diversity possible
• Palo Alto Networks virtual firewalls integrated throughout for unified threat protection
• Multiple redundant transmission paths between points of presence, inherent to the network design rather than an optional extra
• 24/7 network operations centre

The Connectivity brochure describes network presence across Pacific (Australia), United States, Europe (London) and Asia (Singapore) and interconnection with more than 165 data centres worldwide. These are regional and network-reach statements, not a count of four individual points of presence or a guarantee of SASE enforcement at every location. Confirm service availability and policy coverage for each site and user population.

Next-generation firewall and unified threat protection

The Connectivity brochure describes Palo Alto Networks firewalls and the threat-protection capabilities below. Our 21 July 2022 announcement separately describes adding Fortinet SD-WAN, next-generation firewall and SASE capability. These sources do not establish a single vendor for every SASE deployment. Confirm the platform, licences and supported controls in your proposal. The brochure lists:

• Intrusion prevention (IPS)
• Advanced malware protection
• Application control
• Web filtering
• Antispam
• 24x7 support for the protection stack

Secure remote access

The Connectivity brochure describes always-on VPN agents configurable with single sign-on (SSO) and multi-factor authentication (MFA). It does not establish the location of VPN gateways or inspection, or guarantee identical policies for every office and remote user. Confirm traffic routing, inspection and logging locations, identity compatibility, device requirements and policy coverage for your configuration.

Business-grade MPLS data services

The corporate private network extends across sites without requiring a VPN between them. Each office becomes another IP address on the network rather than a tunnel endpoint that has to be built, monitored and renewed. For multi-site organisations this removes an entire category of configuration and a common source of outages.

Quality of Service, end to end

We work with the customer to define which applications are business-critical and apply QoS policy across the network, prioritising voice and video.

This matters specifically for SASE because inspection adds processing to the path. Without QoS, the first symptom of a security control working hard is a degraded call — and the usual response is to weaken the control. QoS is what keeps that trade-off from being forced.

emPOWER Internet and IX peering

• Internet port bandwidth is scalable on request, up or down, without extensive infrastructure change
• Part of the IX peering network, giving faster, lower-latency access to major SaaS platforms including Microsoft 365, Teams, Zoom and Salesforce

Peering is the unglamorous half of user experience. If Teams calls are poor, the cause is frequently the path to Microsoft rather than the local network, and peering shortens that path.

Direct paths to cloud

The Connectivity brochure describes direct Azure or AWS connectivity with a secondary VPN-over-internet path, and direct connectivity to emPOWER Cloud. Confirm which paths are included and how failover is configured. A network connection does not itself include cloud backup or disaster recovery. Confirm those services, recovery objectives and any required certification scope separately in the cloud proposal.

Voice carriage on the same network

Microsoft Teams Direct Routing, SIP trunking, hosted PBX and contact centre solutions run over the same managed network — relevant because voice is the workload most sensitive to the QoS and peering decisions above. See Collaboration.

What we manage

The CPE devices and firewalls that make up the service are proactively managed:

• Monitoring
• Operating system patch updates
• Configuration documentation retention
• Nightly configuration backups
• Change management

Nightly configuration backup is worth weighing when comparing providers. A firewall estate without it is a recovery problem waiting to happen, because rebuilding rule sets from memory after a hardware failure is slow, error-prone, and happens under pressure.

What remains your responsibility

Under the General Terms and Conditions, the customer must:

• Provide 24x7 remote access to the components we manage
• Keep software at the current or previous release level
• Ensure software is properly licensed
• Give blueAPACHE direct telephone access to the customer's own support providers during Business Hours

The last one is the most often overlooked and the most consequential during an incident. If a fault sits with your application vendor, we need to be able to speak to them directly rather than relay through your team at 3am.

Anti-virus on customer-managed equipment is also the customer's responsibility unless the Service Description says otherwise.

The availability figure, and what it actually requires

The emPOWER Connectivity brochure states a minimum 99.99 per cent uptime for its described redundant design. This is not automatically the Service Level for every SASE deployment. Confirm the applicable measurement, exclusions and remedies in your Service Description and Service Order. The brochure describes:

• Multiple carriers for diversity
• Multiple media types — for example fibre and fixed wireless
• Multiple CPE devices and firewalls in high-availability configuration
• Multiple redundant transmission paths between points of presence
• Dual firewalls and dual carriage at each site

A single-carrier, single-firewall site is not covered by that figure. The difference is usually a commercial decision rather than a technical constraint, so it is worth establishing which of your sites are built to the redundant standard and which are not — before an outage settles the question.

Note also that availability obligations are subject to the Reasonable Excuse exclusions in the general terms, which use the test "arises from, or is contributed to by". A partial customer-side contribution is enough to engage the exclusion. See the glossary for the full list.

Commercial and contract points

Term. General Terms v3.6 provide a 36-month Minimum Service Period from the Service Commencement Date, except Professional Services and where the Service Description or Service Order specifies otherwise. Early Termination Payments depend on the applicable termination provisions and Schedule. Confirm the version and negotiated terms governing your order; the terms guide distinguishes the published versions.

IP addresses are not portable. Addresses allocated by us do not transfer with you on exit. For anything with a hard-coded address — firewall rules at partners, allow-lists, DNS, VPN peers to third parties — renumbering is part of the true cost of leaving, and is worth scoping before signing rather than at exit.

Upstream supplier changes. We may suspend or cancel a service where our own upstream supplier withdraws or replaces it. On a carrier-dependent service this is a real, if uncommon, scenario.

Cost pass-through. Third-party cost increases, including exchange-rate movements, may be passed through in the same proportion without a signed Variation.

Service Levels. Only commitments written under the heading "Service Level" in the Service Description are contractual Service Levels. There is no service credit regime in the general terms; any credits sit in the Schedule.

Support windows

The following windows are stated in the emPOWER Connectivity brochure. Confirm the support scope and escalation arrangements applicable to your SASE order.

The emPOWER Managed Services brochure separately describes 24/7 help desk access. Holding that service does not by itself establish that every SASE component or incident is covered. Confirm covered systems, hours, priority definitions and after-hours escalation in the applicable Service Order.

Compliance and certification

The emPOWER Connectivity brochure references ISO 27001 certification, APRA CPS 234, NIST and ASD Essential Eight Maturity Level 3. These are attributed brochure statements, not evidence that a particular SASE configuration has an independent attestation or makes the customer compliant. Request the current certificate and its scope, and agree which controls the service supports, the assessment boundary and the responsibilities retained by your organisation.

How it fits with the rest of the portfolio

Related services can be considered in the design; listing them here does not make them inclusions in a SASE order.

• Connectivity and Core Network and Data Centre Interconnect provide related transport options. Confirm paths and policy enforcement points.
• Security and Managed Detection and Response provide related security capabilities with separately agreed monitoring and response scope.
• Cloud and Collaboration have their own connectivity, application and support requirements.
• Human Risk Management addresses user awareness and behaviour alongside technical controls.

Joining network and security operations

Agree scope for users, sites, devices and security policies as well as connectivity. Identify who approves policy changes, investigates blocked sessions and distinguishes faults from security decisions. Record access paths and redundancy required for availability commitments. Evaluate the service with identity and endpoint arrangements: network access alone does not establish authorisation. Make hand-offs explicit wherever another provider owns a component.

Which document defines the commitment

The published General Terms v3.6 give the Service Order precedence over the General Terms, followed by the Schedules and then the Acceptable Use Policy (clause 2.3). Record the agreed scope, exclusions and negotiated departures in that document set. Keep the versions supplied at signing with the executed order and signed variations. Two offers with the same service name can cover different systems, operating hours or responsibilities.

Responsibility across the delivery chain

The published terms allow us to subcontract all or part of the Service Agreement without customer consent or a notification requirement. Clause 27.5 nevertheless makes us liable for our subcontractors’ acts and omissions to the same extent as for our employees. This differs from a third-party supplier contracted directly by the customer. Identify which arrangement applies to each dependency in the design. Where supplier identity, delivery location or change notification matters, request a documented supplier list and put any agreed notification or approval requirement in the Service Order; the general clause does not supply that visibility automatically.

Confidential information and access

Clause 16 provides mutual confidentiality protection. It covers information marked confidential, information identified orally and confirmed in writing within 30 days, and information that should reasonably be understood to be confidential. Customer Data, Customer Records and Customer Software are included; our agreement and fees are also confidential. Permitted disclosures include appropriately bound personnel on a need-to-know basis and specified professional advisers, with other exceptions in the clause. Identify who may receive operational reports, configuration details and commercial information. Access to information to deliver the service is not a general permission to circulate it.

Continuity when an external event interrupts service

Clause 23 addresses force majeure separately from normal incident management. Performance is suspended to the extent a qualifying event causes delay or failure. The definition includes specified events outside reasonable control; it is not a blanket classification of every outage. If the delay exceeds 20 Business Days, the other party may terminate by written notice. The clause also requires payment for services to termination and the applicable Early Termination Payment. A continuity plan should cover operational recovery and the commercial consequences of prolonged interruption. Confirm the Schedule’s exit calculation rather than assuming an externally caused outage creates a cost-free exit.

Customer content and take-down requests

Clause 14 distinguishes operating the service from responsibility for the customer’s content. It requires the customer to notify us promptly of relevant take-down notices or directions and comply with them. The terms also reserve rights for us to restrict or remove Customer Data in specified circumstances, including suspected agreement breaches or exposure to harm or liability. These rights are separate from routine availability commitments. Agree who receives regulatory notices and who can authorise operational action, and retain the notice and decision record. The full clause, including its discretion and good-faith wording, is explained in the terms guide.

Is SASE an extra cost on top of emPOWER Connectivity?

SASE is part of our Connectivity offering, but the source descriptions do not establish that it has no additional charge. Confirm included components, licences, deployment work and ongoing charges in your proposal and Service Order.

What does "cloud-delivered" mean here?

We describe emPOWER SASE as bringing networking and security together in a cloud-delivered model for distributed users, locations and applications. Enforcement location and traffic paths depend on the design; the description does not guarantee that all backhauling or latency is eliminated. Validate performance for your users and applications.

Which technologies are converged?

SD-WAN, secure access and security policy enforcement, applied across the same managed network.

Which firewall vendor is used?

The Connectivity brochure describes Palo Alto Networks, while our July 2022 announcement describes adding Fortinet SD-WAN, firewall and SASE capability. Confirm the vendor and products specified for your deployment.

Does remote user traffic leave Australia?

The source material does not establish that remote traffic or inspection remains in Australia. Confirm gateway, inspection and logging locations and primary and failover routing for your configuration before relying on a residency requirement.

Can we use our existing identity provider?

The VPN agents can be configured with single sign-on and multi-factor authentication. Confirm compatibility with your specific identity platform during design.

Does the 99.99 per cent uptime apply to all our sites?

The figure is from the Connectivity brochure and depends on its redundant design, including diverse carriers and media, high-availability equipment and dual carriage. It is not automatically a SASE commitment. Confirm the Service Level, measurement and exclusions for each site in your agreement.

Do we still need site-to-site VPNs?

No. Business-grade MPLS extends the corporate private network without a VPN — each office becomes another IP address on the network.

What are the support hours?

The Connectivity brochure describes 24x7 network monitoring and threat protection support, with a service desk from 7am to 7pm on Business Days. Confirm SASE coverage and escalation in your order. A separate Managed Services agreement does not automatically extend coverage to every SASE component.

Who patches the firewalls?

blueAPACHE. Proactive management covers monitoring, OS patch updates, configuration documentation, nightly configuration backups and change management.

Can we increase internet bandwidth later?

Yes. emPOWER Internet port bandwidth is scalable on request, up or down, without extensive infrastructure change.

Do we keep our IP addresses if we leave?

No. Allocated IP addresses are not portable on exit. Scope the renumbering effort before signing if you have hard-coded addresses in partner firewall rules, allow-lists or DNS.

Does SASE replace our need for detection and response?

No. SASE controls and inspects access. Detection, investigation and remediation of what gets through is emPOWER MDR, a separate service.

Can it connect directly to Azure and AWS?

The Connectivity brochure describes Azure and AWS direct connectivity, a secondary VPN-over-internet path and IX peering. Confirm which options are included, the failover design and application performance requirements for your SASE solution.

Does it work with SD-WAN or replace it?

Our SASE description includes SD-WAN alongside secure access and security policy enforcement. The Connectivity brochure describes MPLS and internet SD-WAN options. Agree the transport design and enforcement coverage; the descriptions do not guarantee that every policy applies identically across all paths.

Related

• Connectivity
• emPOWER Core Network and Data Centre Interconnect
• Security
• Managed Detection and Response
• Human Risk Management
• Cloud
• Collaboration
• Managed Services
• Service Agreement terms
• Glossary
• Contact