Local Breakout (LBO) is the SD-WAN practice of routing trusted internet- and SaaS-bound branch traffic directly out to the internet at the local site, rather than backhauling it across the WAN to a central hub or data center for inspection and egress, reducing latency and freeing WAN bandwidth.
Key takeaways
- LBO sends branch internet traffic out locally, skipping the backhaul.
- Cuts latency and data-center WAN load versus central breakout (CBO).
- Applies to all traffic, or only to selected trusted applications.
- Requires extra branch security since traffic skips hub inspection.
- Complicates centralized controls like Azure AD MFA trusted IP lists.
On this page: Why it mattersHow it worksTypesLocal Breakout & VersaFAQ
Why is Local Breakout important?
Legacy WAN design routes every branch’s internet traffic back to a hub or data center over MPLS, where a central proxy or firewall inspects it before it reaches the internet. That worked when applications lived in the data center, but as workloads move to the public cloud and SaaS platforms such as Microsoft 365, hairpinning branch traffic through a central site adds latency, consumes expensive WAN bandwidth, and requires the hub’s network gear to scale for traffic it never needed to touch.
LBO matters because it removes that detour: traffic destined for trusted internet or SaaS destinations exits directly at the branch, over whatever local internet circuit is available. The result is fewer network hops, better throughput for cloud and SaaS applications, and lower bandwidth and equipment costs at the data center. The trade-off is that a branch sending traffic straight to the internet needs its own security controls, since it is no longer protected by the central inspection point.
What is Local Breakout?
Technically, LBO is a form of direct internet access (DIA) implemented through standard routing. A logical connection ties the branch’s tenant VRF to the WAN transport virtual router, and EBGP advertises a default route out that connection so branch traffic prefers the local path over any route learned from the SD-WAN overlay. A NAT/CGNAT rule translates outbound LAN traffic to the branch’s public WAN address before it leaves.
Administrators configure LBO through SD-WAN traffic-steering policy: forwarding profiles select the local breakout as the next hop for traffic that matches given criteria, while everything else can still follow the default route toward a central or regional breakout point. The same infrastructure also supports performance-based selection, where the SD-WAN measures latency and loss across local and remote breakout paths and steers each session to whichever performs best.
Types of Local Breakout
Deployments generally take one of three forms. Full (default) local breakout sends all internet-bound branch traffic out locally, the simplest model, suited to branches where the local circuit and its security controls are trusted. Application-based (selective) local breakout breaks out only specific applications or SaaS groups – such as Microsoft 365 or Salesforce – locally, while other traffic continues to a central or regional breakout point; this is the more common production pattern because it limits local exposure to a defined, trusted set of destinations. Hybrid local-and-central breakout mixes the two by policy, for example routing identity and authentication traffic centrally so it originates from a small set of known IP addresses, while letting general SaaS traffic break out locally for performance. Which pattern fits depends on how much a branch’s local circuit and available security stack can be trusted with unfiltered internet egress.
Local Breakout & Versa
Versa Secure SD-WAN implements LBO on VOS edge devices using the EBGP/CGNAT architecture described above, configured through Director Workflows on the Tunnels tab of a device template, with the option to back a local default route with a centrally or regionally sourced one for redundancy. The Versa SD-WAN Design Guide covers the same application-based and performance-based breakout designs in depth, including SD-WAN policy rules, forwarding profiles, and the passive and active monitoring Versa uses to pick the best-performing breakout path for SaaS traffic such as Salesforce or Microsoft 365.
Versa also documents a hybrid design for organizations using Azure Active Directory MFA: combining LBO with centrally broken-out authentication traffic keeps the list of Azure AD MFA trusted IP addresses small and stable while still letting approved SaaS traffic break out locally at every branch, including branches on dynamically assigned WAN addresses.
Frequently asked questions
What is the difference between local breakout and central breakout (CBO)?
Local breakout sends branch internet traffic straight to the internet at the branch. Central breakout (CBO) instead routes it over the WAN to a central site – a data center or headquarters – for inspection before it egresses. CBO trades performance for centralized control; LBO trades some centralized control for performance.
Is local breakout the same as direct internet access (DIA)?
Effectively yes in Versa’s SD-WAN documentation: DIA describes breaking traffic out to the internet at the branch, and local breakout is the term used for that same branch-sourced egress, as distinct from routing that traffic to a central breakout point instead.
Does local breakout increase security risk?
It can, because traffic no longer passes through a central inspection point. Branches using LBO typically need their own protection – a next-generation firewall function on the SD-WAN edge device or a cloud security service – to enforce the policies a central hub would otherwise have applied.
How does local breakout affect Azure AD MFA trusted IP lists?
Each branch using LBO presents users to Azure AD from its own public IP address, so the trusted-IP list needed to bypass MFA grows with every site and breaks for branches with dynamic WAN addresses. Routing only authentication traffic centrally, while keeping other SaaS traffic on LBO, avoids this.
Can a branch mix local and central breakout for different traffic?
Yes. SD-WAN traffic-steering policy can match specific applications, such as an identity provider, and force them through a central breakout point via a forwarding profile, while a default or catch-all rule sends everything else out locally – the hybrid design most production deployments use.
More on Local Breakout
If you want to learn more, these are sources we trust.
| Cloud Security Alliance |
|---|
| Vendor-neutral guidance on securing branch-to-internet paths as backhaul-only designs give way to local and direct breakout. |
Related terms
If you’re reading about Local Breakout, these are worth looking at next.
| SD-WAN | Traffic Steering | Branch |
|---|---|---|
| The networking approach that uses dynamic path selection and policy to decide where and how traffic, including local breakout, should flow. | The SD-WAN capability of directing traffic across paths and gateways, including toward a local or central breakout point, by policy. | The branch site itself – the location where local breakout, when used, sources its direct connection to the internet. |