5.4Redundancy & high availability

Guaranteeing that a system "does not go down" is not about eliminating failure entirely, but about designing a configuration that minimizes business impact even when a failure occurs. This section covers redundancy techniques for each network layer—gateway, link, route, and device—along with the availability calculations that quantitatively back their effect, aiming to build the judgment needed to decide "which redundant configuration achieves a given availability target."

5.4.1Gateway redundancy (VRRP/HSRP)

• A host recognizes its default gateway as a fixed single IP address and MAC address, so if that single router fails, the host loses reachability to the gateway. VRRP (Virtual Router Redundancy Protocol, a standard) and HSRP (Hot Standby Router Protocol, Cisco proprietary) let multiple physical routers share a virtual IP address and virtual MAC address, presenting hosts with what always appears to be a single virtual router.
• Normally, the master (active) router actually handles traffic to the virtual IP, while the backup (standby) router waits and monitors the master's liveness (via advertisements). If the master stops responding, the backup automatically promotes itself and takes over handling the virtual IP/MAC, enabling failover without any configuration change on the host side.

5.4.2Link redundancy and route redundancy

• Link aggregation (IEEE 802.3ad/LACP) bundles multiple physical links logically into a single, thicker link. It achieves both bandwidth expansion and redundancy (if one link fails, communication continues over the remaining links) simultaneously. LACP automatically negotiates with the peer device, detects link-state changes, and automatically reconfigures the set of active links.
• Route redundancy prepares multiple physically distinct routes (paths through different links and devices) and uses a dynamic routing protocol (OSPF, BGP, etc.) to detect a route failure and automatically reroute. It guarantees that communication continues even if some single point anywhere along the route fails, covering a broader scope than gateway or link redundancy alone.

5.4.3Device redundancy and single point of failure (SPOF)

• Device redundancy duplicates devices such as firewalls or load balancers in either active/standby (normally only one operates, switching to the other on failure) or active/active (both operate simultaneously sharing load, and the remaining one takes over if one fails) configurations. Active/active also makes use of processing capacity during normal operation, but its design for state synchronization (e.g., sharing session information) is more complex.
• A single point of failure (SPOF) is an un-redundant point whose failure stops the entire system. Even if the gateway, link, route, or device is individually made redundant, overall availability does not improve if a SPOF remains at another layer, such as power supply, a circuit contract, or the data center itself. The crux of availability design is to identify SPOFs end-to-end, not just at one specific layer.

Suppose a router's operating record shows an MTBF (mean time between failures) of 720 hours and an MTTR (mean time to repair) of 8 hours. The single unit's availability is availability = MTBF / (MTBF + MTTR) = 720 / (720 + 8) = 720 / 728 ≈ 0.989 (about 98.9%). Setting a core-system availability target of "99.9% or higher" while keeping this router in a non-redundant configuration would clearly miss the target, since a single unit only achieves 98.9%. As a countermeasure, calculate the availability if a second identical router is added and made redundant with VRRP in a parallel (active/standby) configuration. In a parallel configuration, only "both failing at the same time" brings the whole system down, so using the product of failure rates (1 - availability): failure rate per unit = 1 - 0.989 = 0.011, probability both fail simultaneously = 0.011 × 0.011 = 0.000121, so availability after redundancy = 1 - 0.000121 = 0.999879 (about 99.99%), exceeding the 99.9% target. However, this calculation assumes "the two routers fail independently"; if the power supply or circuit contract is shared between the two units (a single point of failure), both could go down simultaneously during a power failure, and this availability would not actually be achieved. So it is only once VRRP-based router redundancy is paired with end-to-end SPOF elimination—including power redundancy (UPS, etc.) and route diversity for the circuit—that the calculated 99.99% availability target can actually be realized. Availability calculation should not stop at "redundancy raises the number on paper," but should also verify that its underlying assumption (independence) still holds as a practical judgment.

5.4.4Section summary

• VRRP/HSRP make the gateway redundant via a virtual IP/MAC; link aggregation gives bandwidth expansion plus redundancy; route redundancy auto-reroutes via dynamic routing
• Availability = MTBF/(MTBF+MTTR). Parallel-redundancy availability is computed as 1 - (product of failure rates), but this fails if the independent-failure assumption breaks down
• A single point of failure (SPOF) must be identified end-to-end (including power supply and circuit contracts), not just at one specific layer of redundancy