Overview
Provides an overview of how to implement Direct Internet Access (DIA) to route branch application traffic directly to the internet using policy-based routing, improving performance, reducing latency, and optimizing WAN utilization in Cisco Secure Firewall.
In this chapter, we delve into the practical application of Direct Internet Access (DIA) using two use cases. Each use case details the scenario, network topology, best practices, and prerequisites. It also provides a comprehensive end-to-end procedure for seamless implementation.
Direct Internet Access
Learn how to use Direct Internet Access (DIA) to route branch application traffic directly to the internet using policy-based routing for improved performance and reduced latency using Cisco Secure Firewall.
Benefits
Summarizes the benefits of DIA for branches, including reduced latency, improved application performance, and optimized internet-bound traffic with Cisco Secure Firewall.
Is This Use Case For You?
Identifies the intended audience for implementing DIA, including network design, operations, and security personnel managing branch internet breakout.
Components for Direct Internet Access
Describes the key components required to implement DIA.
Best Practices
Lists the best practices for implementing DIA at branch sites to optimize traffic routing, enhance performance, and maintain secure WAN connectivity.
Prerequisites
Lists the prerequisites for deploying Direct Internet Access (DIA) at branch sites to ensure network readiness, compatible devices, and secure WAN connectivity.
Scenario 1: Direct Internet Access
Explains a scenario where Direct Internet Access (DIA) with policy-based routing (PBR) improves performance and lowers latency by routing traffic directly to the internet.
Scenario 2: Direct Internet Access With Path Monitoring
Explains a branch office scenario where policy-based routing with path monitoring directs WebEx traffic to minimize packet loss, reduce lag, and improve meeting quality.
Configure a Trusted DNS Server
Provides instructions to configure a trusted DNS server in Firewall Management Center (FMC) so that Threat Defense devices can resolve application domains for DIA traffic.
Configure Interface Priority
Provides instructions to set interface priority for a Threat Defense device to control preferred internet egress paths when routing internet‑bound traffic.
Create an ECMP Zone
Provides instructions to configure an ECMP zone in Firewall Management Cente (FMC) to enable load balancing and high availability across multiple internet interfaces for Direct Internet Access (DIA) traffic.
Configure an Equal Cost Static Route
Provides instructions to configure static routes for interfaces in ECMP zones in Firewall Management Center (FMC).
Configure Path Monitoring Settings
Provides instructions to configure path monitoring in Firewall Management Center (FMC) to collect link performance metrics and guide intelligent egress selection for Direct Internet Access (DIA) traffic.
Configure an Extended ACL Object for YouTube
Provides instructions to configure an extended access control list (ACL) to match YouTube traffic for policy-based routing and Direct Internet Access (DIA) control in Firewall Management Center (FMC).
Configure an Extended ACL Object for WebEx
Provides instructions to configure an extended access control list (ACL) to match WebEx traffic for policy-based routing and Direct Internet Access (DIA) control in Firewall Management Center (FMC).
Configure a Policy Based Routing Policy for YouTube
Provides instructions to configure a policy-based routing policy to steer YouTube traffic across selected internet interfaces in Firewall Management Center (FMC).
Configure a Policy Based Routing Policy for WebEx
Provides instructions to configure a policy-based routing policy to steer WebEx traffic across selected internet interfaces in Firewall Management Center (FMC).
Configure a Policy Based Routing Policy With Path Monitoring for Webex
Provides instructions to configure a policy-based routing policy to steer WebEx traffic through preferred interfaces for optimal performance in Firewall Management Center (FMC).
Deploy Configuration
Provides instructions to deploy Direct Internet Access (DIA) and policy-based routing configurations on Threat Defense devices to enable optimized branch internet traffic flows.
Verify Application Traffic Flow
Provides instructions to verify WebEx and YouTube traffic flow in Firewall Management Center (FMC).
Monitor and Troubleshoot Policy Based Routing
Provides troubleshooting guidance for Direct Internet Access (DIA) issues, including verifying path monitoring, policy‑based routing, ACLs, and egress interface behavior to restore proper internet‑bound traffic flow.
Additional Resources
Lists additional resources to learn about Cisco Secure Firewall features, configuration, verification, and troubleshooting.