Choosing a business ISP failover plan

Two internet bills do not automatically equal internet resilience. The backup circuit only earns its keep when it survives the same failure, carries the work that matters, switches without a technician driving to the office, and gets tested often enough that everyone trusts it.

The goal is not to reproduce a gigabit primary connection at any price. The goal is to keep defined business functions running through a realistic outage.

Start with the business requirement

List what must work when the primary ISP fails:

• Cloud identity, email, and line-of-business applications
• Payment terminals and customer-facing systems
• VoIP calls and contact-center traffic
• Remote access to systems that remain onsite
• Security cameras, alarms, and monitoring that report offsite
• VPN connections between locations or cloud networks

Then decide what can pause. Operating-system downloads, workstation backups, large cloud sync jobs, guest Wi-Fi, and streaming media can usually wait. This gives you a reduced-service bandwidth target instead of buying the secondary circuit by instinct.

Define an acceptable switch time too. A five-minute manual process might be fine for a workshop with one cloud laptop. It is not fine for a busy medical reception desk or a store processing transactions all day.

Buy diversity, not just a second logo

Two carriers can share the same conduit, pole, building entrance, local fiber, or upstream facility. A backhoe does not care whose logo is on the invoice.

CISA’s communications resiliency guidance distinguishes redundant links from genuinely diverse paths and recommends separate pathways or provider termination points where possible. For an SMB, ask both providers direct questions:

• How does each circuit physically enter the building?
• Is either service resold over another carrier’s last mile?
• Do both routes terminate at the same nearby facility?
• Does the backup depend on the same street power or building equipment?
• Can the provider document route or entrance diversity in the order?

A practical secondary link may use a different medium: fiber plus cable, cable plus fixed wireless, or terrestrial broadband plus cellular or satellite. Different media are not magically independent, but they reduce some common failure modes.

Match the backup type to the job

A second wired circuit usually offers predictable capacity and latency. It is attractive for voice-heavy offices and sites that need tunnels to remain useful, but only if the physical route is meaningfully different.

LTE or 5G is fast to deploy and physically separate from the cable entering the building. Confirm signal quality at the installed location, data limits, carrier-grade NAT behavior, antenna requirements, and what happens during a neighborhood power outage when cellular networks are busy.

Fixed wireless or satellite can bypass damaged local cables and may be the best available option at a rural site. Confirm mounting, line-of-sight or sky-view requirements, weather exposure, latency, and any plan restrictions that affect business use.

Do not assume a backup with an impressive speed test can support inbound services. Its public addressing, NAT, firewall policy, and provider terms may differ from the primary circuit.

Configure failover for an actual outage

Use a firewall or edge router that supports dual-WAN health checks and automatic failover. A physical link-up signal is insufficient: a modem can remain synchronized while upstream internet access is broken.

Health checks should test useful reachability beyond the local modem. Avoid relying on one target that can fail independently. Set thresholds so a single lost packet does not flap the office between circuits, and require a stable primary path before failing back.

Expect some sessions to reset. The public IP address changes during failover, so voice calls, VPN tunnels, remote sessions, and SaaS connections can reconnect. Systems that allowlist the primary public IP may fail completely until the secondary address is authorized. Inbound NAT and externally published services need a separate design; basic outbound failover does not solve them.

Document both circuits, modem ownership, account numbers, support contacts, public addressing, firewall ports, and health-check behavior in your network truth file. A password hidden in one former employee’s inbox is not a continuity plan.

Keep essential traffic usable

When the backup is smaller, enforce a degraded-service policy automatically:

• Pause guest access and nonessential software downloads.
• Limit bulk backups and cloud synchronization.
• Prioritize voice and critical application traffic where the network supports it.
• Alert an operator that the site is on backup and may be consuming metered data.

Quality of service cannot create bandwidth that does not exist, but it can stop one large transfer from crowding out ten small business-critical sessions.

Remember the supporting equipment. The firewall, switches, access points, ISP handoff, cellular modem, and any external antenna power supply need appropriate battery backup. A diverse circuit connected to a dead switch is just an expensive status light.

Test failure and failback

NIST’s contingency controls call for alternate telecommunications services, reduced shared points of failure, and regular testing. The full NIST contingency-planning guidance treats recovery as a coordinated combination of procedures and technical measures—not a product purchase.

During a quiet but staffed window:

1. Record the primary and secondary status and public addresses.
2. Disconnect the primary handoff in a controlled way.
3. Time detection and failover.
4. Test DNS, cloud apps, payment workflows, calls, VPNs, and monitoring.
5. Confirm nonessential traffic is limited as designed.
6. Restore the primary and verify stable failback.
7. Review alerts, logs, and metered usage.

Test after firewall changes, carrier changes, and at a regular interval—quarterly is a reasonable starting point for many small offices. Record exceptions and owners instead of accepting “the cellular bars look good” as evidence.

Bottom line: choose failover from the work that must continue, then buy a path that does not share the primary circuit’s obvious failure points. Automate detection, plan for address and session changes, protect the supporting power, and pull the primary cable on purpose. A backup internet connection that has never carried a real workflow is still a theory.