For the past decade, the gold standard for UK enterprise WAN resilience was the Dual-Hub SD-WAN topology: dual high-availability next-generation firewall (NGFW) clusters hosted in carrier-neutral data centres (typically London Slough and Docklands), connected to branches via redundant leased line overlays. Every megabit of branch traffic was backhauled to the hub, inspected through on-prem security blades, and forwarded to the public internet.
With 80% or more of enterprise workloads now residing in Microsoft 365, Teams, Salesforce, and public cloud environments, this "trombone" or "hairpin" pattern creates unacceptable latency, consumes costly WAN transit, and overwhelms firewall CPU resources during deep packet inspection.
The Latency Hairpin: Why Backhauling Breaks Cloud Apps
When a remote office in Manchester accesses Microsoft 365 or AWS under a dual-hub design, traffic follows an inefficient route:
- Packet travels from Manchester over an IPsec tunnel to the London data centre hub (10–14ms latency).
- Central NGFW decrypts the TLS payload, scans for threats, re-encrypts, and routes out to Microsoft's London peering edge.
- Return packets repeat the path back through the central firewall before returning to Manchester.
This adds 20–30ms of round-trip time (RTT) overhead to real-time collaboration tools. Under Secure Access Service Edge (SASE), the branch uses local Direct Internet Access (DIA) to hit the vendor's nearest regional edge PoP directly, reducing transit latency to under 4ms while inspecting traffic in a single-pass cloud architecture.
Architectural Comparison Matrix
The matrix below outlines the operational differences between a pure SASE model, a traditional Dual-Hub NGFW deployment, and a pragmatic Hybrid SASE architecture:
| Architectural Dimension | Pure Cloud SASE (SSE) | Dual-Hub On-Prem NGFW | Hybrid SASE (Recommended) |
|---|---|---|---|
| Traffic Path & Hair-Pinning | Direct Internet Access (DIA) breakout locally to nearest UK SSE cloud PoP (<5ms) | All branch traffic backhauled via leased line to DC1/DC2 hubs before egress | Direct SaaS breakout via SSE; private ERP backhauled over encrypted SD-WAN |
| TLS / SSL 1.3 Decryption | Distributed cloud scale; zero compute overhead on branch edge hardware | Constrained by physical ASIC/CPU limits of central firewall appliances | Cloud-native inspection for web/SaaS; on-prem NGFW for internal DC boundaries |
| Branch Hardware Demarcation | Thin Edge: lightweight SD-WAN router or software agent on endpoint | Fat Edge: heavy UTM/NGFW stack requiring continuous firmware maintenance | Standardized lightweight SD-WAN appliance with automated IPsec SSE tunnels |
| Legacy On-Prem / ERP Access | Requires Zero Trust Network Access (ZTNA) connectors in data centre | Native L3 routing and deterministic BGP IPsec tunnels over point-to-point lines | Sub-millisecond line-rate routing to internal core; ZTNA for remote workers |
| Regulatory & Sovereign Data Boundaries | Must ensure SSE provider guarantees in-country UK sovereign data residency | 100% on-premises data isolation within enterprise-controlled racks | Audit-certified sovereign transit for internal databases; global SSE for internet |
| Suitability Verdict | Recommended | Challenging | Exceptional |
Sovereignty & Legacy Core: Where Dual-Hub Still Wins
Despite SASE's latency advantages, a pure cloud model introduces challenges for specific UK enterprise workloads:
- Data Sovereignty & Compliance: Public sector, legal, and financial enterprises subject to strict regulatory oversight must ensure that inspection PoPs never route unencrypted payloads through foreign jurisdictions.
- Legacy Client-Server ERPs: Legacy platforms (such as on-prem SAP, bespoke AS400 systems, or medical PACS imaging) perform poorly over HTTP-based ZTNA reverse proxies, requiring deterministic Layer 3 routing over private circuits.
This is why the majority of UK enterprises adopt a Hybrid SASE topology: a lightweight "thin-edge" SD-WAN router routes public SaaS traffic directly to regional SSE nodes, while private enterprise subnets travel over dedicated point-to-point circuits directly into sovereign data centres.
Modernising Your Enterprise WAN Architecture?
ManagedByUs designs and manages hybrid SASE and resilient dual-hub architectures. We provision dedicated DIA leased lines, configure Zero Trust Network Access, and eliminate firewall bottlenecks. Use our Bandwidth Calculator to size your branch breakout requirements, or talk to an enterprise architect.