Enterprise Edge Dual-WAN Stateful Failover Solution

Enterprise branches, campus network egress points, production sites, and edge locations commonly use two WAN (Wide Area Network) links to reduce the impact of a single carrier, circuit, or edge-router failure. For sites that provide only general Internet access, restoring connectivity and allowing applications to reconnect may be sufficient. As remote operations, internal service publishing, video transport, industrial communications, and edge computing become more prevalent, however, enterprises increasingly require their edge high-availability systems not only to restore reachability, but also to preserve established business sessions whenever possible.

VRRP (Virtual Router Redundancy Protocol) is widely used at the enterprise edge to provide router redundancy through a virtual gateway. In a dual-WAN environment, however, failover involves more than the LAN (Local Area Network) default gateway. It may also involve public addresses on two ISP (Internet Service Provider) paths, NAT (Network Address Translation) state, and symmetric forwarding in both directions. If only the virtual gateway moves, existing sessions may still fail because the public-facing identity changes, runtime state is unavailable on the Backup Router, or return traffic follows the wrong path.

This document presents an AsterNOS-VPP dual-WAN stateful high-availability solution for the enterprise edge. It begins with a dual-WAN redundancy architecture based on a single VRRP instance, then introduces VRRP Sync Group, HA Sync (High Availability Synchronization), SPI (Stateful Packet Inspection), and PBR (Policy-Based Routing). Together, these capabilities coordinate the ownership of WAN- and LAN-side virtual addresses and allow the Backup Router to inherit supported runtime session state.

The document focuses on architecture, key technologies, failover behavior, deployment design, and engineering considerations. It does not provide a complete CLI (Command-Line Interface) configuration. Detailed commands and step-by-step validation procedures can be provided in a companion configuration guide or best-practices document.

This document is intended for solution architects, network designers, and deployment engineers. Readers should have the following background:

• Familiarity with Asterfusion ET Series intelligent gateway platforms
• Familiarity with the AsterNOS-VPP network operating system
• Working knowledge of enterprise networking, router redundancy, address translation, and static routing

Enterprise sites generally need to address both link redundancy and device redundancy. Link redundancy allows a site to continue reaching external networks through the second WAN link after a carrier circuit fails. Device redundancy allows the Backup Router to take over the LAN default gateway and restore forwarding if the Active Router fails.

Some sites must also publish the same internal application through public addresses provided by different ISPs. For example, remote operations personnel may access an internal SSH (Secure Shell) service through either carrier path, while internal servers may need to reach external systems through a designated uplink. In this situation, the edge routers perform routing, NAT, stateful inspection, and path control. The object of failover is therefore no longer a single gateway address, but an end-to-end service forwarding path.

For ordinary web access, a failed session can often be recovered by refreshing the page. For remote administration, continuous data transfer, industrial communications, and long-lived TCP (Transmission Control Protocol) sessions, however, reauthentication and reconnection increase recovery time. Dual-WAN stateful failover should therefore be designed according to the required level of business continuity.

This architecture consists of two routers and one LAN-side VRRP virtual gateway. Both routers connect to ISP-A and ISP-B, but under normal conditions only the VRRP Active Router forwards LAN traffic. The Active Router maintains a preferred default route and a backup default route, and uses SLA (Service Level Agreement) probes together with Track objects to determine whether the ISP next hop is reachable.

If ISP-A fails while ISP-B remains available, the Active Router does not need to trigger a VRRP failover. It simply withdraws or invalidates the preferred route through ISP-A, allowing new flows to use ISP-B. This preserves the healthy uplink on the current Active Router and avoids a full device switchover for a single-WAN failure.

If the Active Router fails, its LAN-facing interface fails, or both WAN uplinks become unavailable, the LAN Gateway VIP (Virtual IP Address) moves to the Backup Router, which then begins forwarding new traffic. The architecture separates dual-WAN path failover from router failover, resulting in simple and predictable fault handling for general enterprise Internet egress.

The primary benefit of this design is that it provides dual-ISP access, dynamic NAT for outbound connectivity, and router redundancy with relatively few virtual addresses and limited state coordination. It is well suited to short-lived traffic, where applications can reconnect even if the public source address changes after failover.

The dual-WAN stateful high-availability architecture adds two WAN VIPs while retaining one LAN Gateway VIP. The three virtual addresses represent the public-facing identity on ISP-A, the public-facing identity on ISP-B, and the internal default gateway. Although they belong to separate VRRP instances, all three instances are members of the same VRRP Sync Group.

Under the initial baseline conditions shown in the topology, Router-A operates as the Active Router, while Router-B operates as the Backup Router. These are runtime VRRP roles rather than fixed device identities. Router-A owns all three VIPs and handles business traffic, while Router-B receives synchronized session state. If any critical member fails, all three VRRP instances fail over together and Router-B takes ownership of all three VIPs. The two WAN service endpoints and the LAN gateway therefore remain concentrated on the same router. Static DNAT (Destination Network Address Translation) and dynamic SNAT (Source Network Address Translation) both use the WAN VIPs as service addresses, preserving the public-facing identity across failover.

The state-synchronization link between the routers transfers supported NAT, SPI, and LB session state. After an inbound connection reaches an internal server through either WAN VIP, PBR selects the ISP next hop associated with the original ingress path so that return traffic leaves through the same WAN. Address ownership, session state, and bidirectional path consistency therefore operate together as a complete high-availability system.

The two architectures address different levels of availability. The single-instance VRRP architecture centers on the LAN virtual gateway, performs WAN path failover within the Active Router, and restores forwarding after a device failure. The stateful architecture moves the WAN public identities, LAN gateway, and supported runtime state as one service unit.

VRRP provides default-gateway redundancy through a virtual router. Multiple physical routers share a VIP and a virtual MAC address. One router operates as the Active Router, responds to ARP requests for the VIP, and forwards traffic, while the other router operates as the Backup Router and listens for VRRP Advertisements. If the Active Router fails, the highest-priority Backup Router transitions to the Active Router, takes ownership of the virtual address, and sends a gratuitous ARP to update neighboring forwarding tables.

Standard VRRP instances operate independently. A state change on one interface does not automatically force VRRP instances on other interfaces to switch. This independence keeps a single-LAN-gateway design simple. In a dual-WAN stateful architecture, however, two WAN VIPs and one LAN Gateway VIP form one service path. If the instances elect their Active Routers independently, a local failure can split VIP ownership across the two routers.

VRRP Sync Group coordinates state transitions across multiple independent VRRP instances. If a critical member enters the Down state or a Track condition reduces its priority, the other members on the same router adjust their effective priorities according to the group policy. The peer router can then take ownership of the complete VIP set. VRRP Sync Group coordinates virtual-address ownership; it does not transfer session state.

In a typical design, Router-A can be assigned a priority of 200 and Router-B a priority of 190, with a Priority Decrement of 20 applied to Router-A group members. If any critical member on Router-A fails, its effective priority drops to 180, allowing Router-B to become the Active Router for all group members.

Stateful network functions depend not only on configuration, but also on session entries created dynamically while traffic is processed. NAT records address and port mappings, SPI records connection state, and LB (Load Balancing) services may maintain associations between clients and backend servers. A Backup Router with identical configuration but without this runtime state may still be unable to process established traffic correctly after it takes over the service addresses.

HA Sync transfers supported runtime session state across the synchronization link between the two routers. The current implementation supports synchronization of SPI, NAT, and LB session state. In this architecture, NAT and SPI state provide the basis for continuing inbound static DNAT and outbound dynamic SNAT sessions after failover.

HA Sync is not configuration synchronization. Both routers must be preconfigured with matching VRRP Sync Group membership, NAT rules, SPI policies, PBR policies, and routing. The synchronization link carries runtime state only, allowing the Backup Router to match sessions that were established on the Active Router after it takes over the VIPs.

NAT translates IP addresses and ports between address domains. DNAT is commonly used to map a public service address to an internal server, while SNAT translates an internal host address to a public egress address. In a dual-WAN high-availability design, NAT must do more than perform translation: it must preserve the public-facing identity before and after router failover.

In this dual-WAN stateful failover architecture, two WAN VIPs serve as the public service identities for ISP-A and ISP-B. Static DNAT can map the same or different ports on both WAN VIPs to the same internal service, while dynamic SNAT uses the corresponding WAN VIP as the translated source address. Whether Router-A or Router-B is forwarding traffic, the remote peer continues to see the same public address.

SPI evaluates subsequent packets according to connection establishment and state transitions. If NAT mappings are present but SPI state is missing, the Backup Router may still classify packets from an established connection as invalid. HA Sync therefore synchronizes supported NAT and SPI session state so that translation and stateful inspection remain consistent after failover.

PBR selects a next hop or egress interface according to conditions such as source address, destination address, and ingress interface. Unlike conventional destination-based routing, PBR can steer selected traffic over a designated ISP path.

In a dual-WAN static DNAT scenario, requests may reach the same internal server through ISP-A or ISP-B. If the server’s return traffic is forwarded only according to the default route, it may leave through the other ISP, causing the NAT state, source address, and return path to become inconsistent. The architecture applies PBR on the LAN-facing path so that traffic entering through ISP-A returns through ISP-A, while traffic entering through ISP-B returns through ISP-B.

The deployment architecture uses two AsterNOS-VPP routers with the same hardware model and software version. Each router connects to ISP-A, ISP-B, and the downstream service network, with a dedicated interface used for the Session Sync connection. The ISP-facing and LAN-facing segments may use Layer 2 switching to provide shared broadcast domains. The upstream and downstream switches provide connectivity and Layer 2 forwarding only; they do not participate in the VRRP Sync Group or session-state synchronization.

Under normal conditions, Router-A operates as the Active Router for both WAN links and the LAN, while Router-B operates as the Backup Router and receives synchronized runtime state. Internal application servers can be published through both WAN VIPs. Their outbound traffic reaches the Active Router through the LAN core and the LAN Gateway VIP.

The following addresses are taken from a standardized functional-validation topology and are provided only to illustrate the network design.

The three VRRP instances on Router-A can be assigned a higher priority, while the corresponding instances on Router-B use a lower priority. The Priority Decrement must be planned according to the initial priority difference so that, when any critical member triggers a priority reduction, Router-B has a higher effective priority than Router-A.

Validation should cover address ownership, inbound traffic, outbound traffic, session continuity, and new-connection handling.

The solution can be deployed on ET Series hardware platforms, as dula-wan routers, that support AsterNOS-VPP. It can also be validated functionally in a compatible virtualized environment. Platform selection should consider the required number of WAN and LAN interfaces, interface speeds, aggregate site throughput, and the combined processing requirements of NAT, SPI, VPN (Virtual Private Network), and other services.

For small and medium-sized branches and enterprise Internet egress, the ET2500 Series provides a suitable option for moderate bandwidth and multi-rate connectivity. For high-bandwidth campus cores, data-center egress, or large edge sites, the ET3600 Series provides higher interface speeds and forwarding capacity.

Enterprise dual-WAN high availability can be implemented at different levels according to business-continuity requirements. The single-instance VRRP redundancy architecture combines WAN path failover within the Active Router with LAN-side VRRP, restoring traffic forwarding after a link or device failure. It is suitable for general Internet access and short-lived sessions.

For public service publishing, remote operations, and long-lived connections, the dual-WAN stateful high-availability architecture uses a VRRP Sync Group to coordinate the ownership of two WAN VIPs and one LAN Gateway VIP, HA Sync to replicate supported SPI, NAT, and LB session state, and PBR to maintain the correct return path.

This allows enterprises to evolve from restoring egress reachability to moving the complete service path and its runtime state. The appropriate architecture can be selected according to site criticality, deployment complexity, and session-continuity requirements.

For detailed commands, configuration sequencing, and step-by-step validation procedures, refer to the companion AsterNOS-VPP configuration guide.