Communication Channel Redundancy: Part 1 — Why It's Needed and How It Works

When the office loses internet or the switch in the server room fails, everything that depends on the network stops: mail, CRM, cloud accounting, IP telephony, order processing on the website. Redundancy of communication channels is a set of measures whereby the failure of one cable, device, or provider does not lead to a shutdown. This series covers redundancy at three levels: inside the building, between offices, and at the internet edge.

Where to start: how much downtime is acceptable

Before buying a second link or a second switch, determine two values.

• RTO (Recovery Time Objective) — how long it should take to restore the service after a failure. For an e-commerce website this may be minutes; for an internal file server — hours.
• RPO (Recovery Point Objective) — how much data loss is acceptable, i.e. how fresh the last backup must be. For communication channels RPO is usually important indirectly: if transactions are interrupted during switchover, they must be retried or restored.

The choice of solution depends on RTO. If an hour of downtime is acceptable, a backup channel that is switched on manually is enough. If only seconds are acceptable, you need automatic failover and equipment that is not itself a single point of failure.

What availability percentages mean

Providers and cloud services promise availability as percentages. It’s more convenient to convert that into hours and minutes of downtime. Calculations for a year of 365 days (8,760 hours) and a 30-day month:

Two important consequences.

1. The availability of the chain is lower than the availability of each element. If a service depends on a provider with 99.9%, a router with 99.9% and a switch with 99.9%, the availability of the whole chain is about 99.7% — i.e. more than a day of downtime per year.
2. Two independent channels dramatically increase availability. If each of two providers is available 99% of the time and their failures are uncorrelated, a simultaneous failure happens 0.01% of the time — less than an hour per year. The key word is “independent”: more on that below.

What usually breaks

• Physical line. A cable is damaged during roadworks or inside the building, fiber gets kinked, a copper patch cord is pulled out during cleaning.
• Equipment. A switch power supply, a port, an SFP module, or a server network card fails.
• Provider. A backbone outage, node maintenance, a routing error, an unpaid invoice.
• Power. Without a UPS on the router and switch the backup channel is useless: it will shut down along with the primary.
• Configuration. A mistake in router or firewall configuration can stop the network as effectively as a cable cut.

Independence of channels and route diversity

A second channel only protects against failures that do not affect it simultaneously with the first. Typical pitfalls:

• Single cable entry. Two providers bring cables into the building through the same cable duct, and one excavator incident severs both. When connecting, ask providers how their routes run, and, if possible, bring cables in from different sides of the building.
• Single upstream operator. Two different providers may lease capacity from the same backbone operator or be located on the same exchange. Ask this question before signing a contract.
• Single device at the entry. Two links connected to the same router will both be disabled if that router fails.
• Single medium type. For a backup channel in an office it’s common to choose a different technology: fiber plus a radio link, or mobile internet via an LTE/5G router.

Levels of redundancy

It’s convenient to consider redundancy from the bottom up.

1. Inside the building: two NICs in the server, two switches, link aggregation, spare SFP modules, UPS.
2. Between offices: multiple VPN tunnels via different providers, leased lines, MPLS, own fiber, SD-WAN, gateway redundancy using VRRP.
3. Internet edge: two providers with automatic failover, BGP with your own Autonomous System, DNS with availability checks, CDN.

The bottom level is the cheapest and protects against the most common failures. There’s no point in setting up BGP with two providers if all servers are connected to a single switch without backup power.

Monitoring: a backup that hasn’t been tested won’t work

A backup channel can sit unused for months and fail exactly when needed. Therefore:

• monitor the status of both channels, not just the one currently carrying traffic;
• receive a notification for every switchover — otherwise you might operate on the backup for weeks without knowing the primary has failed;
• once a quarter perform a dry-run shutdown of the primary channel at an agreed time and measure how long the switchover takes;
• record which services lose connections during switchover: telephony and VPN clients often require reconnection.

How much to invest

It’s reasonable to compare the cost of redundancy with the cost of downtime: how much the company loses per hour without connectivity — revenue, paid employee hours, contractual penalties. For a small office a second provider using a different technology and a router with automatic failover is often enough. Services that generate revenue around the clock need a higher level.

How to match the level of protection with business requirements is discussed in the article “Four levels of fault tolerance: which level are you at and what do you really need”.