Dual internet access: why a badly configured backup link leaves you stranded

Having two internet connections is not enough to guarantee business continuity. If your backup link has not been configured to take over all of your traffic, business applications and VPN tunnels included, the failover fails the day the fibre goes down, and you stay stranded despite the second connection. Real internet redundancy is not decided by plugging in a second line, but by how it is configured, how it fails over automatically and how regularly it is tested. Here is how to get it right, and which technologies are viable today (a second fibre, 4G/5G, Starlink).

The false sense of security of “we have a backup”

Today almost everything you do goes over the internet: IP telephony, your cloud-based business software, mail, the links to your other sites, sometimes the point of sale or production monitoring. An outage on the main connection means a business at a standstill. And outages do happen: a digger cutting through a duct, a fault at the operator, an incident on the local network of your business park.

Faced with that risk, many organisations have put in a second connection, often a 4G or 5G router “just in case”. The intention is right. The problem is that this second link is rarely configured to do the job properly. On the day of the outage, you discover that 4G keeps web browsing and mail going, but the business software no longer responds, telephony stays silent and the remote sites cannot be seen. The backup is plugged in, the business is blocked anyway.

The trap: a backup link only half configured

This is what we see most often in the field. A backup link is only worth something if all of your traffic has been planned to move onto it. Three things are almost always forgotten.

First, IPsec VPN tunnels. If your sites, your remote workers or your cloud access go through encrypted tunnels, those tunnels have to be declared and configured on both connections. A tunnel built only on the fibre will not come back up by itself on 4G: it has to be prepared in advance, with the right addresses and the right routes.

Next, critical applications and telephony. Voice over IP, business software, the payment terminal and off-site backup each have their own traffic, their own ports and sometimes their own priorities. Without a routing policy designed for the backup link, those services lag behind or do not get through at all.

Finally, testing. A backup that has never been put through real conditions is a false sense of security, exactly like a backup that has never been restored. You only find the problem at the worst possible moment. The only way to have confidence is to simulate the outage and check, service by service, that everything keeps working.

That is precisely the work our teams carry through to the end: we do not just install a backup box, we configure the VPN tunnels on both links, the routing for each application and the telephony, then we test the failover so that it really is transparent on the day.

Choosing two connections that do not fail together

Redundancy only means something if your two links are independent. Two fibre lines from the same operator, running through the same duct and the same exchange, will often go down together. The point is therefore to diversify the technology, the operator and, as far as possible, the physical route. Three options are viable today as a backup for an SMB, a mid-sized company or a public authority.

• A second fibre, preferably from another operator and on a different connection point. It is the best performing option where it is available, but it has to be genuinely independent of the first to be of any use.
• 4G/5G FWA (Fixed Wireless Access, fixed internet over the mobile network). This is the most common backup and one of the best value, with throughput ranging from 300 Mbit/s to 1 Gbit/s on 5G. Provided you check the real coverage at your site and size the router properly.
• Starlink (satellite internet), worth considering in areas poorly served by fibre, or as a backup completely independent of terrestrial networks. To be weighed against a sovereignty caveat: the operator is American and subject to the Cloud Act, which deserves thought if you handle sensitive data. As a backup for browsing and continuity it remains a solid option; for primary use on critical data, the question is open.

The right choice depends on where you are, on the throughput you need and on how critical your activity is. On some poorly connected sites in the Var hinterland or the Bouches-du-Rhône, a well-received 5G signal or a Starlink link delivers a service that fibre cannot yet offer.

SD-WAN and automatic failover: the technical glue

Once both connections are in place, you need equipment able to drive them. That is the role of SD-WAN (Software-Defined WAN) and, more simply, of the multi-WAN functions of a professional firewall. The principle: a box continuously watches the state of your links and routes traffic to the best available connection. If the main connection goes down, automatic failover redirects the traffic to the backup link with no human intervention, then switches back once the fibre is restored.

SD-WAN goes further than simple backup. It lets you send each application over the most suitable link, prioritise voice and video conferencing so they stay smooth, and in some cases aggregate links to add throughput together. For a multi-site organisation, that is a gain in resilience and quality every day, not only on the days something breaks.

Our teams build on Stormshield firewalls, designed in France and certified by ANSSI, the national cybersecurity agency, which include these multi-WAN and SD-WAN functions as well as IPsec VPN tunnel management. The same device therefore handles security filtering, internet backup and the interconnection of your sites, under a single policy. Combined with our monitoring, it alerts us if a link drops, often before you notice it yourself.

Doing the job properly, all the way

Business continuity is not declared by adding a box in a corner. It is built: a review of your connections and your critical traffic, the choice of two genuinely independent links, the complete configuration of the failover (VPN tunnels, applications, telephony, routing), then a test under real conditions and monitoring over time. It is that last stage, testing and follow-up, which separates a backup that reassures from a backup that works.

IT1 Connect works with SMBs, mid-sized companies and public authorities across the Provence-Alpes-Côte d’Azur region on the whole chain: advice and sizing, deployment of the second connection (a second fibre, 4G/5G or Starlink depending on your site), SD-WAN configuration on a Stormshield firewall, managed services and monitoring of the whole arrangement. The objective is simple: on the day your main connection goes down, you should barely notice. To review your internet redundancy, an engineer who already knows your environment is on +33 4 22 14 04 63.