Designing Backup Internet That Actually Takes Over

Backup links fail in production for predictable reasons: DNS still points at the primary, VPN tunnels stay bound to the old IP, or nobody tested failover during business hours. Design backup internet as a system behavior, not a spare modem in a box.

Define what up means

ICMP to a public resolver is a weak health signal. Prefer probes against your firewall, SaaS dependencies, or carrier DNS. Set sensible hold-down timers so brief blips do not bounce the entire site between paths.

Plan for stateful services

VoIP registrations, site-to-site VPNs, and cloud security agents may need rebind time after path change. Document which services recover automatically and which require a controlled restart sequence.

Exercise failover quarterly

Schedule a controlled switch during a maintenance window. Measure how long critical apps need to stabilize. Gateways with integrated batteries can bridge short power events; pair that hardware capability with tested WAN policy so software failover matches hardware intent.