What is DIA?

Direct Internet Access (DIA) is a branch connectivity model in which internet-bound and SaaS traffic breaks out to the internet directly at the branch site, instead of being backhauled over the WAN to a central hub for inspection, cutting latency and freeing up bandwidth at headquarters.

Key takeaways

• Breaks internet-bound traffic out locally at the branch, not a hub.
• Cuts latency and removes hairpin hops for SaaS and cloud traffic.
• Needs its own NAT and security stack at every breakout point.
• Central or regional breakout backs up a failed local circuit.
• Performance-based steering picks the fastest DIA point per app.

On this page: Why it matters · How it works · Types · DIA & Versa · FAQ

Why is DIA important?

Legacy branch networks backhaul all traffic to a hub over a private WAN link, where a centralized proxy and firewall stack inspects it before it reaches the internet. That made sense when applications lived in the data center, but it adds latency and consumes hub bandwidth, degrading the experience for cloud and SaaS applications that never needed to touch the hub at all.

DIA matters because reliable internet circuits made local breakout economical, and the shift to public cloud and SaaS platforms such as Office 365 made it necessary. Breaking traffic out at the branch reduces bandwidth requirements at headquarters, removes network hops, and lowers latency. The trade-off: a branch sending traffic straight to the internet is directly exposed, so DIA designs must budget for security controls a centralized breakout point used to provide for free.

What is DIA?

Architecturally, DIA is built on standard routing, not a special protocol. A logical connection is created internally between a tenant’s VRF and the WAN transport virtual router, and the VRF uses EBGP to advertise a default route toward that transport VR, resolving its next hop over the logical tunnel between them. Outbound traffic then follows that route out the local WAN link instead of crossing the overlay toward a hub.

A NAT rule – NAPT or CGNAT – translates all outbound LAN traffic to a shared public IP address, the same way a home router hides a private network behind one internet-facing address. This differs from a split tunnel to a private underlay, such as an MPLS network: DIA always applies NAT, while a private split tunnel typically does not.

Types of DIA

DIA deployments fall into a few common patterns, and most designs combine more than one. Local breakout sends each branch’s internet traffic out its own WAN link – the baseline model that captures most of DIA’s benefits. Central or regional breakout acts as a backup: a less-preferred default route points to a hub or regional site and activates automatically if the local circuit fails. Application-based breakout sends specific traffic, such as a named SaaS application, out locally while other traffic routes centrally, limiting exposure to only trusted applications. Performance-based breakout goes further, using latency and loss measurements to automatically pick the best breakout point – local or remote – per application.

DIA & Versa

On VOS edge devices, DIA is configured through Versa Director Workflows rather than hand-built routing: enabling DIA on a tunnel automates EBGP peering between the transport VR and LAN VR and provisions the CGNAT function that translates outbound traffic. WAN links can share one BGP local preference for load balancing, or use different preferences for local-with-central-backup redundancy, as detailed in the Consolidated SD-WAN Design Guide and Versa SD-WAN Design Guide.

Because a DIA branch is directly exposed to the internet, Versa recommends attaching IDS/IPS and antivirus to every DIA-facing firewall rule, with SSL decryption enabled so encrypted flows can actually be inspected. Versa’s SaaS application monitoring and DNS proxy features let a forwarding profile pick the lowest-latency breakout point automatically, so performance-based DIA doesn’t require manually pinning applications to a path.

Frequently asked questions

What is the difference between DIA and a split tunnel?

DIA is a specific kind of split tunnel: one that breaks internet-bound traffic out locally and applies NAT to hide LAN addressing behind a public IP. A split tunnel to a private underlay, such as an MPLS network, typically skips the NAT step, since there’s no address to hide from a trusted network.

Why does DIA need extra security at the branch?

A centralized breakout point lets one firewall and proxy stack inspect all internet traffic. DIA removes that chokepoint, so each branch that breaks out locally becomes its own exposure point and needs its own IDS/IPS and antivirus to keep the same security posture.

Can DIA be made redundant across multiple WAN links?

Yes. A branch can advertise a default route from each WAN link at different BGP local preferences, so one link is primary and another takes over automatically if it fails, or set every link to the same preference for active load balancing across them.

How does application-based breakout work?

An SD-WAN forwarding profile and policy rule match a specific application, such as a named SaaS app, and steer only that traffic to a local next hop, while the rest of the branch’s internet traffic keeps using the default route toward a central or regional breakout.

Does DIA always require NAT?

Yes, for internet breakout specifically. The DIA configuration creates a NAT rule that translates outbound LAN traffic to a shared public IP address. A split-tunnel breakout to a private underlay doesn’t require this, because it isn’t exposing LAN addresses to the public internet.

Related terms

If you’re reading about DIA, these are worth looking at next.