Understand what a single connection actually protects
One circuit through one device in one facility is a single point of failure regardless of how the provider markets it. Meaningful redundancy means separate connections terminating on separate devices, ideally at separate locations, over separate physical paths from separate carriers.
Ask for the fiber route, not just the location name. Two circuits into the same building through the same conduit fail together when a backhoe finds the conduit.
Design the routing policy explicitly
BGP is where intent becomes behavior. Decide in advance which path is primary, how traffic should behave when one path degrades rather than drops, and how return traffic will flow — asymmetric routing through stateful firewalls is a recurring cause of intermittent, hard-to-diagnose failures.
Use local preference and AS path prepending deliberately, apply prefix filters in both directions, and cap advertised route counts so a leaked route table cannot destabilize the link. Bidirectional forwarding detection shortens failure detection from tens of seconds to sub-second.
Back the interconnect with an encrypted tunnel
A site-to-site VPN over the internet is a legitimate backup for a dedicated circuit, provided the fallback bandwidth and latency are acceptable for the workloads that will land on it. Document which applications degrade gracefully and which must be shed.
Encryption expectations should be settled during design. Dedicated circuits are private but not inherently encrypted, and regulated workloads frequently require encryption in transit regardless of path privacy.
Test failover on a schedule
Redundancy that has never been exercised is an assumption. Run resiliency tests that actually take a path down during a maintenance window, measure convergence time, verify that MTU and fragmentation behavior hold on the backup path, and confirm monitoring detected the event.
Capture the results in the runbook with observed numbers, then re-test after every material change to the topology or firewall rule set. The goal is a hybrid path whose worst-case behavior is known rather than discovered.
Key takeaways
- Diverse devices, locations, carriers, and physical paths — verify the fiber route.
- Control primary and backup behavior with explicit BGP policy and prefix filters.
- Size the VPN backup against the workloads that must survive on it.
- Take a path down on purpose, measure convergence, and record the numbers.
Working through this in your own estate?
TalentOp Systems designs, provisions, and operates hybrid infrastructure for regulated, multi-site enterprises.
Start an infrastructure assessment