SASE / network security (SS-26 Network)

What it does

SASE / network security

SS-26 is the largest surface in the suite: a sovereign network fabric with a mesh overlay / SDP control plane, zero-knowledge WireGuard coordination (a native Headscale/Tailscale replacement), full SASE (SWG, CASB, DLP, FWaaS, ZTNA), SD-WAN with app-aware steering and QoS, VPC/subnet primitives, residency controls, and a topology emulation lab. The keystone is the UPO — a Unified Policy Object you author once and compile to ztna, sdwan and firewall rulesets, then apply with a diff.

Sub-capabilities

The real surface, grouped.

Mesh overlay & native WireGuard

Create SDP-controlled mesh overlays; enroll peers with public key only (private material rejected); generate WireGuard netmaps, wg-quick configs and NAT-traversal plans; native coordination poll replaces Headscale map-poll; seamless mesh-wide re-key.

Tailnet (Tailscale-style access)

Enroll and authorize devices, set the tailnet ACL and posture rules, issue ephemeral/reusable auth keys, MagicDNS, exit nodes, subnet-route advertisement/approval, and expose k8s Services into the tailnet.

SASE — SWG, CASB, DLP, FWaaS, ZTNA

Set Secure Web Gateway policies, CASB SaaS controls, DLP inspection profiles and FWaaS rules; author default-deny ZTNA policies and evaluate an access request, recording the session verdict.

SD-WAN

Create overlay tunnels, set app-aware path-selection policies and QoS classes, record link SLA probes, and compute an app-aware steering decision per tunnel.

UPO — unified policy compiler

Author one tenant policy, validate it fail-closed, compile it to ztna | sdwan | firewall rulesets, apply a compiled target and get the diff vs the last-applied baseline, and browse the version history.

VPCs, residency & emulation

VPCs and subnets, per-class residency rules with validation and audit, and a topology emulation lab to validate a proposed change against the emulated network before it ships.

Endpoints

Real method + path — SS-26 Network.

A representative slice of the 82 operations on SS-26. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.

POST/api/v1/meshCreate a sovereign mesh overlay (SDP control plane).

POST/api/v1/mesh/{id}/peersZero-knowledge peer enrollment (public key only).

GET/api/v1/mesh/{id}/peers/{device}/netmapGenerate the peer's WireGuard netmap.

POST/api/v1/mesh/{id}/peers/{device}/rekeySeamless mesh-wide re-key.

POST/api/v1/tailnet/devicesEnroll a device into the tenant tailnet.

PUT/api/v1/tailnet/aclSet the tailnet ACL/policy.

POST/api/v1/sase/ztna/policiesCreate a ZTNA access policy (default-deny).

POST/api/v1/sase/ztna/grantEvaluate a ZTNA request and record the verdict.

POST/api/v1/sase/swg/policiesSet a Secure Web Gateway policy.

POST/api/v1/sase/dlp/profilesSet a DLP inspection profile.

POST/api/v1/sdwan/tunnelsCreate an SD-WAN overlay tunnel.

POST/api/v1/sdwan/steerCompute an app-aware steering decision.

POST/api/v1/upo/policyAuthor (create/replace) the unified policy; bumps version.

POST/api/v1/upo/compileCompile the policy to ztna | sdwan | firewall rulesets.

POST/api/v1/upo/applyApply a compiled target; returns the diff vs baseline.

PUT/api/v1/residency/{class}Set a data-residency class rule.

Full endpoint catalog →

Worked example

Publish one UPO policy to ZTNA, SD-WAN and the firewall

The UPO compiler is the point: author intent once, compile it to three enforcement targets, apply with a diff — no per-box policy drift.

SS-26 Network · bash

# 1. Author the unified policy (bumps the version)
curl -X POST "$BASE/upo/policy" -H "$AUTH" -H "$TENANT" \
  -d '{"rules":[{"app":"payments","allow":["role:engineer"],
        "posture":"managed","path":"gold"}]}'
#  → { "version": 12 }

# 2. Validate fail-closed, then compile to all three targets
curl -X POST "$BASE/upo/policy/validate" -H "$AUTH" -H "$TENANT"
curl -X POST "$BASE/upo/compile" -H "$AUTH" -H "$TENANT" \
  -d '{"targets":["ztna","sdwan","firewall"]}'
#  → { "compiled": { "ztna": {...}, "sdwan": {...}, "firewall": {...} } }

# 3. Apply each target — the response is the diff vs last-applied
curl -X POST "$BASE/upo/apply" -H "$AUTH" -H "$TENANT" \
  -d '{"target":"firewall"}'
#  → { "target":"firewall", "diff": { "added":[...], "removed":[...] },
#      "baseline_version": 11, "applied_version": 12 }

One authored policy, three consistent rulesets. ZTNA is default-deny; grants are evaluated per request and the session verdict is recorded — the same intent the SD-WAN steering and firewall rules enforce.

Architecture placement