← All Blogs

Your internet goes down. Does anything actually fail over?

By Best IT MSP Editorial Team - Updated October 20, 2026 - 10 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Does a backup internet connection actually fail over?

No. A backup internet connection fails over only when a device sits between both circuits, detects that the primary has dropped, and moves traffic to the secondary on its own. That device is usually a dual WAN router. Without it, a second line is a spare, not a redundant network.

Most small businesses believe they already have a business internet backup, because someone once mentioned a second connection. The second circuit often does exist. Nothing is watching it. The first person to notice the outage is a customer, and the fix is a phone call to the provider who is already down.

The cost of getting this wrong is measured, not theoretical. Uptime Institute reports that 57 percent of organizations said their most recent major outage cost more than $100,000, and that one in five put the cost above $1 million for the second year running. It also found that outages linked to fiber and connectivity issues are rising and are more likely to cause extended disruptions. Connectivity is becoming the weak link, not the server room.

This guide gives you a test you can run in one afternoon, the three failure modes that quietly break most setups, and the three ways to fix it in honest price order. Read it beside Business Continuity vs Disaster Recovery, which covers the planning split, and What 24/7 Monitoring Actually Means, which covers who is watching at 2am.

What failover needs, in three parts

Failover has three parts, and most businesses have bought only the first.

• Two paths. A primary circuit and a failover circuit that share no equipment, no provider, and no trench.
• A device that decides. A dual WAN router or firewall that monitors the primary, detects the drop, and reroutes traffic with nobody touching it.
• A rule for what moves. Which traffic gets the limited backup bandwidth first, which is what QoS settings are for. QoS simply means giving some traffic priority over the rest.

Buy one part and you own a spare line. Buy all three and you own automatic failover. The difference shows up only during an outage, which is the worst possible moment to find out which one you have.

Three things that break the illusion of redundancy

Three failure modes account for most redundancy that does not work. Each one survives a sales conversation and fails a real outage, and each one takes about ten minutes to check.

Your backup circuit may ride the same trench as your primary

Two circuits from two different brands often share one physical path into your building. The shared part is the last mile, the stretch of cable between your office and the nearest carrier facility. One digger cuts both, and both providers tell you the same repair time.

Dig damage is not a rare event. The Common Ground Alliance analyzed 221,717 unique buried-utility damage reports for 2025 and found telecom and cable lines took 51 percent of all facility damage, the largest share of any utility. Its damage index reached a record 102 in 2025, up from 94 in 2023.

The more useful finding for your office sits underneath that number. Seventy percent of those telecom hits came from crews working on something else entirely, led by water work at 22 percent and natural gas and electric work at 11 percent each. The single biggest root cause was no notification to the 811 one-call center, at 22.3 percent of all damages. Nobody was digging for your fiber. They hit it anyway. That is why your provider's reliability record answers the wrong question.

Ask for a diverse path in writing, and verify three specifics: the entry point into the building, the conduit each cable runs in, and the carrier facility each circuit terminates in. Carrier diversity on the invoice is not carrier diversity in the ground, because many retail providers resell the same wholesale last mile. A wireless backup is diverse by construction, because it leaves the building through the air.

Internet fails over. Your VPN and phone system may not.

Web traffic survives a failover because each new request simply takes the new path. A VPN session and a live VoIP call do not, because both hold session state tied to the public IP address the connection started on.

The internet's own standards say this plainly. The TCP specification states that a connection is defined by a pair of sockets, meaning the two IP addresses and ports it began with. Change your public address and that pair no longer exists. IPsec has the same constraint, which is why engineers had to publish a separate extension for mobility: in base IKEv2, it is not possible to change these addresses after the security association has been created.

The practical result is easy to picture. When the dual WAN router switches to the 5G backup, staff on a VPN session get dropped and have to reconnect. Calls already in progress on a VoIP handset end. New calls work fine. Anything that trusts your static IP address stops trusting you, because your address now belongs to the mobile carrier. Bank portals with an IP allowlist and remote access gateways both behave this way.

Voice has a second problem on a wireless path. Jitter is the variation in how evenly packets arrive, and voice tolerates very little of it. A cellular link usually carries plenty of bandwidth for calls, because voice needs a small fraction of what video needs, but it can deliver that bandwidth unevenly. Set QoS so voice gets priority on the backup path, then test an actual call rather than a web page. Our guide to Hosted VoIP vs On-Premise covers where the phone system itself lives.

Ask which systems hold session state and what each one does during a switch. A provider who has thought about failover answers in seconds. One who has not will talk about the router.

Nobody has unplugged the primary during business hours

An untested failover is a guess, and the only test that counts is pulling the primary circuit while people are working. An overnight test proves the router works. It does not prove that your staff, phones, card terminals, and main application all work on a slower path with a different address.

Federal guidance treats connectivity as something you plan to lose. FEMA lists connectivity to a service provider, including fiber, cable and wireless, among the components a recovery strategy must anticipate losing, and states that the recovery time for an IT resource should match the recovery time objective of the business function depending on it. Most businesses have never written down a recovery time objective for their internet, which is why the gap stays invisible.

The odds say it matters. Uptime Institute found that about one in ten respondents said their most recent outage had serious or severe impacts, and that third-party IT and data center providers, including telecoms, accounted for roughly two-thirds of publicly reported outages across nine years of tracking. The failure is usually not yours. The recovery always is.

How to test your internet failover in one afternoon

To test failover, book 45 minutes on a normal working day, tell the team what is happening, then unplug the primary circuit from the router and watch six things in order.

• Start a stopwatch as you unplug, and record the seconds until web browsing works again. Anything past 60 seconds means nothing automatic is happening.
• Call a mobile from a desk handset, then call the handset back, and note whether the call in progress survived the switch.
• Open your main business application and save a record, not just a login screen.
• Check the VPN session on one remote laptop, and time how long it takes to reconnect.
• Test card payments and anything behind an IP allowlist, because a static IP change breaks those silently.
• Plug the primary back in and time the switch back, which some routers handle badly.

Write down the six results and the date. That single page is now the most useful network document your business owns, and it is the thing to hand a new provider during a switch. If your current provider runs the test for you, ask for the same six timings, and ask them to run it at 11am rather than 11pm.

Repeat it twice a year, because circuits get re-routed and router firmware changes behaviour. Continuity tooling assumes you prepared in advance. CISA's Business Continuity in a Box, published in November 2023, is described as an interim solution for an organization or its managed service provider to stand up critical functions during an incident. An interim measure only helps if somebody opened it before the incident.

Testing discipline is the same habit that separates working backups from hopeful ones, which we cover in When Was Your Backup Last Restored?.

The three rungs of internet failover, cheapest first

Three options cover almost every small business, in this price order: a 5G or LTE backup, a second wired circuit from a different carrier, then SD-WAN. Match the rung to your size and your tolerance for being offline, not to the brochure.

A 5G backup, for a single office under about 25 people

A 5G backup suits one site, cloud-based applications, and a business that can work slower for a few hours. The kit is a dual WAN router with a cellular modem, or a small appliance beside the firewall you already own. Coverage has stopped being the obstacle in most towns. The FCC reported that approximately 91 percent of Americans lived in areas with 5G coverage at minimum speeds of 35 Mbps down and 3 Mbps up, measured at the end of 2022, and coverage has only grown since.

Confirm three things before you buy. Signal strength at the spot the antenna will actually sit, not at the front door. The data allowance, because a full day of failover for a 20-person office consumes far more than a phone plan expects. And whether the mobile carrier is genuinely separate from your wired provider, which some bundled deals are not.

A second wired circuit, for 25 people and up

A second wired circuit suits a business that cannot run slower, keeps servers on site, or depends on steady upload bandwidth for voice and video. Buy it from a carrier using different physical infrastructure, such as fiber as primary with cable as secondary, and get the diverse path confirmed in writing before you sign anything.

Availability is the real limit. The FCC found that 100/20 Mbps fixed broadband had not been physically deployed to approximately 7 percent of Americans as of its December 2022 data, and in plenty of commercial buildings only one fiber provider has ever built in. Where a second wired circuit is genuinely unavailable, the honest answer is a cellular backup plus a shorter recovery expectation, not a more expensive router.

Read your ISP SLA at this point, and read it for two numbers only. The committed repair time, and what the credit is worth. An ISP SLA quotes an uptime percentage and pays a prorated slice of a monthly fee. It does not pay for the day you lost.

SD-WAN, which is often oversold to a two-site business

SD-WAN earns its cost when you run several sites, several circuits, and traffic worth steering differently, and it is frequently oversold below that line. SD-WAN is software that watches multiple paths continuously and moves individual application traffic to the best one, with its own policy and QoS engine.

The value comes from choice. One office with two circuits gives you two paths and one sensible rule, which a dual WAN router already enforces for a fraction of the monthly cost. With two sites the arithmetic is usually still against it. Ask the vendor to name which applications would be steered and where they would be steered to. A vague answer means you are buying a managed service wrapper rather than path selection.

SD-WAN also does not fix the trench. Steering traffic across two circuits that share one conduit still leaves you with one physical path and one digger.

What an hour offline costs, and what to ask your provider

Work out your own hourly cost of downtime before you compare quotes, because that number decides which rung you need. Multiply the people who cannot work by $46.89, which is what the Bureau of Labor Statistics reported as the average total employer compensation cost per hour worked for private industry workers in June 2026.

A 20-person office idles at roughly $938 an hour in payroll alone, before a single lost sale or missed deadline. Set that against Uptime Institute's finding that 57 percent of major outages cost more than $100,000 and the enterprise statistic starts to look like your statistic. Compare your hourly figure with the monthly quote for a 5G backup, and the decision usually makes itself. A resilient setup is often the cheap one.

Five questions settle whether your current setup fails over.

• Name the device that detects the outage and switches traffic, and show me its configuration.
• Confirm in writing that the two circuits use a diverse path and different carriers at the last mile.
• List which systems drop during a switch, including every VPN session, VoIP calls, and anything using our static IP address.
• Tell me the date and time of the last live failover test, plus the six timings from it.
• State what our ISP SLA pays out if the primary circuit is down for a full working day.

A provider who answers all five is managing the risk. A provider who answers the first and stalls on the rest has sold you a second circuit, not automatic failover. None of this makes a network immune to outages, and no honest provider claims otherwise. It buys you something better than a promise, which is knowing exactly what happens before it happens.

FAQ

Is a second internet connection the same as failover?

No. A second connection is only a spare path. Failover needs a device, usually a dual WAN router, that monitors the primary, detects the drop, and switches traffic automatically. Uptime Institute reports that outages tied to fiber and connectivity are rising and more likely to cause extended disruptions.

How do I test internet failover without disrupting the business?

Unplug the primary circuit from the router for 45 minutes on a normal working day, after telling the team. Time the switch, then test a phone call, a VPN session, a card payment, and one save in your main application. FEMA guidance says recovery time should match the recovery time objective.

Will my phone system keep working if the internet fails over?

New calls work. Calls already in progress usually drop, because voice holds session state tied to your public IP address. The TCP standard defines a connection by a pair of sockets, so a changed address ends it. Set QoS so voice gets priority on the backup path.

Is a 5G backup good enough for a small office?

Yes, for a single site, cloud applications, and a few hours of slower work. The FCC reported about 91 percent of Americans live where 5G reaches at least 35 Mbps down and 3 Mbps up. Check signal at the antenna position, the data allowance, and that the mobile carrier differs from your wired provider.

Do I need SD-WAN for a two-site business?

Usually not. SD-WAN pays off with several sites, several circuits, and traffic worth steering per application. With two sites, a dual WAN router plus a 5G backup covers the same outage for far less. Ask the vendor to name the applications it would steer and where.

← All Blogs