FortiPortal SD-WAN Steering Hierarchy: DIA vs RIA Explained
Confused by nested SD-WAN steering rules and dynamic interface tokens like $(inet1) in FortiPortal? Here is how FortiOS evaluates Rules 1 through 7 top-down, and how to ensure SaaS traffic routes directly without latency.
PortalPilot translates cryptic logs and routing tables into plain English in 1 second and generates copy-ready FortiOS CLI change tickets with instant rollbacks.
🔍 Raw Telemetry & What It Means
Template: BRANCH-SD-WAN-TEMPLATE1 | Rule 5 (BR-IT-LIBO) -> DIA Local WAN | Rule 6 (BRANCH-IT-NET-TO-RIA) -> Encrypted HUB Backhaul
Branch traffic is steered across multiple WAN circuits based on SLA performance targets (latency, jitter, packet loss).
Rule 5 (Direct Internet Access / DIA) steers latency-sensitive SaaS traffic (Microsoft 365, Teams) directly out the local branch ISP, bypassing corporate firewalls. Rule 6 (Remote Internet Access / RIA) backhauls all other internet traffic across IPsec HUB tunnels for centralized inspection.
⚡ Actionable Solution & Command Specs
Paste this validated FortiOS syntax directly into your management terminal or ITIL change ticket:
config service
edit 5
set name "BR-IT-LIBO"
set mode sla
config sla
set health-check "Default_AWS"
set link-cost-factor latency
end
set priority-members 1 2
next
end❓ Frequently Asked Questions
What is the difference between DIA and RIA in FortiOS SD-WAN?
DIA (Direct Internet Access) routes branch internet traffic directly out local broadband/fiber circuits to minimize SaaS latency. RIA (Remote Internet Access) tunnels branch traffic back to an enterprise headquarters or datacenter HUB for centralized security inspection and filtering.
What do $(inet1) and $(inet2) tokens mean in FortiPortal templates?
In FortiPortal multi-tenant templates, $(inet1) and $(inet2) are meta-variables. When pushed to a 40F firewall, $(inet1) binds to wan1. When pushed to a 100F, it dynamically maps to port1 without requiring separate manual device configurations.
How does PortalPilot help with SD-WAN steering rules?
PortalPilot inspects the live SD-WAN rules table in FortiPortal, validates the top-down rule evaluation order, checks SLA member health, and flags when unapproved non-SaaS traffic is accidentally bypassing corporate security via DIA.
Understand FortiPortal Telemetry in 10 Seconds
PortalPilot installs in 1 click into Google Chrome, Microsoft Edge, and Brave. 100% on-device zero-trust execution.