Question

A network engineer enables Cloud OnRamp for SaaS on two branch WAN Edge routers, each configured with a Direct Internet Access (DIA) exit through its local ISP. Users at the branch report intermittent session drops when accessing a cloud SaaS application. Investigation shows that outbound SaaS traffic can leave through either of the two DIA interfaces depending on the best-performing path, but return traffic sometimes arrives on the opposite interface, breaking stateful NAT translations. Which configuration action best resolves the asymmetric-flow problem while preserving OnRamp for SaaS path optimization?

Accepted Answer

Configure the DIA interfaces so that SaaS application flows are pinned to a single NAT-enabled exit per flow, ensuring symmetric forwarding while OnRamp probes still select the best interface at flow start

Answer

Disable Cloud OnRamp for SaaS and route all SaaS traffic over the SD-WAN overlay to a centralized data center exit

Answer

Increase the SaaS application probe interval on both interfaces so path selection changes less frequently

Answer

Replace DIA with a SIG tunnel to a cloud-delivered firewall on each router to eliminate local NAT