A branch has Direct Internet Access enabled. Users can resolve DNS, but application traffic fails. You find that the internet speed test also fails…

The symptoms described—DNS resolution succeeding while application traffic fails—strongly point to a Network Address Translation (NAT) or firewall policy issue. In a Versa SD-WAN Direct Internet Access (DIA) scenario, Carrier-Grade NAT (CGNAT) is commonly used to translate private branch IP addresses to a public IP for internet access. If the CGNAT rule is misconfigured or not matching the application traffic, DNS queries (UDP/53) might work, but subsequent TCP/HTTP/HTTPS connections will fail. Checking the CGNAT and associated DNS forwarding rules is the logical first step.

B. OSPF area ID and BGP MED: These are routing protocol attributes that are irrelevant to a basic DIA failure where initial DNS lookup already works.

C. SNMP community and syslog server: These are configurations for network monitoring and logging; they do not impact the forwarding of user application traffic.

D. VRRP priority and DHCP lease time: These relate to gateway redundancy and IP address assignment, which are unlikely causes if DNS resolution is already successful.

1. Versa Networks, "Versa Secure SD-WAN Configuration Guide," Release 21.2.2, Section: "Configuring DIA Using a Centralized Internet Gateway," pp. 345-350. This section details the necessary components for DIA, including NAT pools and rules which are fundamental for application traffic to exit to the internet.

2. Versa Networks, "CGNAT Configuration Guide," Release 22.1.0, Section: "Troubleshooting CGNAT," p. 28. This guide outlines common issues where misconfigured NAT rules can block specific types of traffic while allowing others, consistent with the scenario.