Backhaul is the network link or path that carries traffic from an edge location back toward a central site or core network. In enterprise networking, it most often describes routing a branch’s traffic, including internet-bound traffic, over the wide area network to headquarters or a data center before it goes anywhere else. In telecom, it describes the links that carry traffic from cell sites or local access equipment into a carrier’s core network. In both senses, backhaul is about the middle of the path, not the connection into the building or out to the internet.
At a glance
- Enterprise backhaul sends branch traffic to a central site, often to apply central security or reach data center applications.
- Telecom backhaul connects cell sites and access networks to a carrier’s core, commonly over fiber or microwave.
- Backhauling cloud and internet traffic adds distance and delay and consumes WAN capacity.
- SD-WAN and cloud security services let organizations send some traffic directly to the internet instead.
- A central site carrying backhauled traffic can become a single point of failure for many branches.
What problem it solves
Backhaul exists because some functions are central. A company running applications in its own data center needs branch traffic to reach it. A company that inspects all internet traffic at one firewall stack needs that traffic to pass through the central site. A mobile operator needs every cell site to reach the core network where calls and data are processed.
Backhaul makes that possible with links designed to carry aggregated traffic from many edges to a center. In traditional enterprise designs, MPLS networks often carried branch traffic, including internet traffic, back to headquarters, where a central internet connection and security stack served the company.
How it works
Enterprise WAN. Branches connect over private WAN services, VPN tunnels or SD-WAN. Routing sends traffic for data center applications, and often for the internet, to the central site. There, firewalls and other controls inspect it before it reaches the internet or internal systems.
Telecom and wireless. Cell sites, Wi-Fi hotspots and remote access equipment send traffic over fiber, microwave, copper or sometimes satellite links to aggregation points and then into the carrier’s core. Capacity and latency on these links shape what the edge can deliver.
Capacity and latency. Backhaul links carry the combined traffic of many users or sites, so they need to be sized for aggregate peaks. Each extra hop adds latency, which matters for voice, video and interactive cloud applications.
Resilience. If many sites backhaul through one data center or one link, an outage there can affect all of them. Redundant central sites and diverse paths reduce that risk.
Moving away from full backhaul. With most applications now in the cloud, many organizations send trusted traffic straight to the internet from each branch, using SD-WAN for path control and secure access service edge (SASE) or local firewalls for security. Others keep backhaul for specific traffic types that require central inspection.
Our SD-WAN page explains how buyers weigh backhaul against direct internet access at branches.
When it matters for buyers
- Slow cloud applications at branches. Backhauling SaaS traffic through headquarters is a common cause.
- WAN renewals. Moving internet traffic off private WAN links can change how much capacity you need.
- Security redesign. Shifting from central firewalls to SASE or branch security changes which traffic you backhaul.
- Remote and wireless sites. Cell sites, DAS and private cellular projects need backhaul with enough capacity and resilience.
- Resilience reviews. Check whether one central site or link is a single point of failure for many locations.
Questions to ask vendors
- Which traffic will be backhauled to central sites, and which will go directly to the internet?
- How will security be applied to traffic that does not pass through the central site?
- What capacity and latency should we expect on backhaul links, and how are they measured?
- What happens to branches if the central site or its connections fail?
- For wireless or remote sites, what backhaul medium will be used, and what are its capacity and availability targets?
- How will the design change as we move more applications to the cloud?
How it differs from the last mile
The last mile is the access connection into a customer’s building from the provider’s network. Backhaul carries traffic onward from an access or aggregation point, or from a branch, toward a core network or central site. A tail circuit is the provider’s term for the access segment that reaches your site. A branch’s last-mile circuit can be one part of a backhaul path, but backhaul describes where traffic is sent, not just how the building is connected.