What is an "Internet breakout"

Question

I was asked this by a friend. His company is trying to set up some sort of a network where all their branches around the world can connect. They want to know if there are any laws in my country associated with "Internet Breakout"

He is a lawyer at the said place and since he has no idea about technology, he asked me. I have no idea what on god's name he's talking about since I am not a networking guy.

I did try searching around google for what "Internet Breakout" is, but I have no idea how to explain this to my friend.

If anyone could give me a quick summary of what an internet breakout is in a company network, or point me to a resource that would explain it. I would be really appreciate it.

Answer 1

In many large networks that span nationally or globally, all traffic including Internet traffic, flows from remote sites to a central hub, such as a data center, where Internet traffic then leaves the organization via an ISP. The advantage of this is the organization can apply security policies, filter for malware, etc., from a single, central location.

In contrast, some organizations allow Internet traffic to leave the corporate network at the remote site, via a locally connected ISP. This is known as an "Internet breakout." The advantage of this is all the Internet traffic does not need to be carried to the central site, saving on bandwidth, and the local ISP may offer cheaper pricing than the central site. The downside is that Internet filtering and malware protection must be placed at the remote site's ISP connection as well.

I'll let someone else speak to the legal issues involving transnational Internet traffic.

Answer 2

In addition to Ron Trunk's answer, I might add that there are now SaaS-style solutions that put proxy/web filtering functionality in cloud nodes distributed worldwide. This allows you to have centrally-controlled security, but decentralized access which avoids backhauling Internet traffic across your MPLS.

So you would implement a cheap Internet link on each site, and use it to send traffic to the cloud node, where it is filtered (policy compliance, antimalware...) and passed on to the Internet. You send traffic either via a PAC file in the browser, via some sort of tunnel (GRE, IPSec) or a combination of both.

I've deployed this in some fairly exotic countries, with no major issues so far. We can show that we log everything if need be, and I haven't encountered any places where access to these cloud nodes is wholly blocked, except sometimes in China when the Great Firewall gets grumpy. Performance is sometimes problematic though, particularly in Latin America and Africa, but way better than the alternatives.