MPLS VPN dual-link backup: designing a real failover
Backup links fail for three reasons: single-target probing causes false positives, routing convergence is too slow, and the backup path is never exercised so misconfigurations surface only during an outage. Design for multi-target probing, sub-second detection and quarterly drills.
"We have a backup broadband line" often turns out to be untrue during an actual outage. The problem is rarely the absence of a backup — it is that the switch does not happen when needed.
1. Failure one: single-target probing
Many configurations ping one target, typically the HQ gateway, to decide whether the primary link is up. If that target itself fails, or ICMP is filtered by policy, the device misjudges and flaps between links.
Use multi-target probing: probe the HQ gateway, a core application server and a public DNS resolver simultaneously. Require at least two consecutive failures before declaring the link down.
2. Failure two: slow routing convergence
If failover depends on OSPF or BGP convergence, the switch can take 30 seconds to minutes — which means users must log in again to ERP sessions.
Design notes:
- Use BFD to bring failure detection into the millisecond range
- Configure floating static routes as a floor, so failover does not rely solely on dynamic protocols
- For session-oriented applications, design for application-level reconnect
3. Failure three: the backup path is never used
A backup link carries no traffic during normal operation, so configuration errors, expired certificates and peer policy changes go unnoticed until the day it matters.
The fix is rehearsal: manually disconnect the primary every quarter, verify the switch, confirm business availability, then verify switch-back. Record the timing and use it as SLA evidence.
4. How to accept the switchover time
Acceptance is not "it reaches". Measure:
- Seconds from disconnecting the primary to business recovery
- Number of sessions lost during the switch
- Whether switch-back introduces routing loops or suboptimal paths
Typical targets: critical business within 30 seconds, voice traffic within 5 seconds to avoid dropping the call.
5. Choosing the backup type
MPLS plus broadband IPSec: lowest cost, but backup quality depends on the internet. Acceptable for non-real-time workloads.
Dual-carrier MPLS: two circuits on different carriers with physically separate paths. Highest reliability and highest cost — appropriate for trading and healthcare.
MPLS plus 4G/5G: useful for temporary sites or as a third layer. Limited bandwidth but fast to deploy.
Frequently asked questions
- How long should failover take?
- It depends on probing and convergence. With BFD, detection is milliseconds and total switchover is typically 3–30 seconds. Measure and record it during acceptance.
- Should the backup link carry traffic normally?
- Yes, ideally some non-critical traffic, or at minimum run scheduled failover drills. Backup links that are never exercised commonly fail when finally needed.