Summarized on October 2, 2026
Direct Internet Access (DIA) on Cisco SD-WAN allows branch routers to break out internet-bound traffic locally rather than backhauling it through a data center [1]. Enabling DIA requires two configuration steps:
- Enable NAT on the transport interface in VPN 0.
- Direct traffic from the service VPN using one of two methods: - Static NAT Route: Add a static NAT route under the service VPN feature template, which installs a default NAT DIA route. - Centralized Data Policy: Create data prefix, VPN, and site lists, then define a data policy that matches source prefixes and sets the action to use NAT VPN 0, applied from the service side.
To improve DIA resilience, the NAT DIA Tracker feature periodically probes the transport interface to detect internet availability [2]. If the internet path becomes unavailable, the NAT Fallback feature allows traffic to use an alternative path, preventing drops. Configuration involves three steps: creating a tracker in the System feature template (specifying threshold, interval, multiplier, and endpoint type), binding the tracker to the NAT transport interface, and enabling NAT fallback on the existing DIA centralized data policy.
Cloud OnRamp for SaaS extends DIA by automatically identifying the best network path for SaaS application traffic such as Microsoft 365, Webex, and Salesforce [3]. From Cisco IOS XE Catalyst SD-WAN Release 26.1.1, Cloud OnRamp for SaaS also supports Secure Service Edge (SSE) tunnels, enabling devices to probe multiple SSE tunnels and select the best one for reaching SaaS application servers. Applications are configured through the SD-WAN Manager workflow or Policy Groups using Cloud Monitoring and Cloud SLA actions, and telemetry settings for Microsoft 365 and Webex can be independently enabled to provide rich application visibility and optionally influence best-path selection.