How to set up automatic dual-WAN failover with local BGP

Why traditional failover falls short in critical environments

When a business relies on uninterrupted internet connections, relying solely on basic load balancing or simple ping scripts often leads to headaches. In practice, this means that if the primary carrier loses connection to the rest of the world, but the cable remains plugged into your router, a blind cable-link test might assume everything is fine and keep routing traffic into a black hole. To solve this in demanding enterprise networks, we must turn to dynamic routing protocols that communicate directly with carrier infrastructure or manage strict local policies.

BGP (Border Gateway Protocol, the protocol governing how data travels between different networks on the internet) is often associated only with large transit providers. However, using it locally on your company's edge routers completely transforms your resilience posture. Before diving deeper into configuration, remember that managing infrastructure bottlenecks goes beyond networking, requiring attention to other subsystems as well, as detailed in our guide on how to diagnose IOPS bottlenecks on Linux to keep storage stable under operational stress.

How local BGP works at the network edge

Local BGP acts as an intelligent messenger between your main router and the modems or edge routers provided by your two internet service providers. Instead of blindly sending all traffic to a fixed default gateway, the router talks via BGP with each carrier to discover which routes are actually active and efficient at any given moment. In practice, if Carrier A's circuit experiences extreme slowness or severe packet loss, the protocol detects the state change and reroutes data flow to Carrier B within seconds, without users noticing the disruption.

To set up this architecture, the edge equipment must support eBGP (External BGP) sessions with the edge routers of each ISP. Each carrier provides a private Autonomous System (AS) number for the local session. The big secret of this approach is that failover decisions no longer depend on a fragile script running in the operating system; instead, they become a native, deterministic policy decision made by the router's control plane.

Configuring redundancy and path attributes

Practical configuration requires defining which link will be the primary one and which will act strictly as a backup. To accomplish this in BGP, we use path attributes, with AS-Path Prepend being the most common and accessible mechanism. In practice, injecting repetitions of your own AS number into the advertisement sent to the secondary carrier makes that path look longer and less attractive for returning traffic, ensuring Carrier A remains the main route while healthy.

Beyond tuning outbound traffic, we must rigorously monitor inbound paths. If you already master internal traffic shaping, you should also review how to configure VLANs and inter-VLAN routing on a switch to properly isolate edge traffic before it reaches the network core. Below is a simplified configuration example on an edge router using FRRouting syntax or Linux-based routers:

router bgp 65000
  bgp router-id 192.168.100.1
  neighbor 203.0.113.1 remote-as 65001
  neighbor 198.51.100.1 remote-as 65002
  !
  address-family ipv4 unicast
    network 192.0.2.0/24
    neighbor 203.0.113.1 activate
    neighbor 203.0.113.1 route-map PREFER-ISP1 in
    neighbor 198.51.100.1 activate
    neighbor 198.51.100.1 route-map BACKUP-ISP2 in
  exit-address-family
!
ip prefix-list PL-LOCAL permit 192.0.2.0/24
route-map PREFER-ISP1 permit 10
  set local-preference 200
route-map BACKUP-ISP2 permit 10
  set local-preference 100
  set as-path prepend 65000 65000

Validating convergence and testing failover in practice

After applying the configuration, the most critical moment is simulating a real failure to ensure the system reacts exactly as planned. Unplugging the physical cable of the primary carrier is the ultimate litmus test. In practice, you should observe how long the router takes to drop the BGP session due to missing Keepalives and fully take over the secondary link. If this takes longer than thirty seconds, users running real-time services like video calls or VoIP will notice annoying drops.

To mitigate delays in detecting failures where the cable remains plugged in but the carrier loses upstream connectivity, we enable BFD (Bidirectional Forwarding Detection). BFD sends ultra-fast test packets every millisecond, notifying BGP immediately of any physical or logical anomaly. Thus, the transition between links shifts from a slow event to something imperceptible for corporate applications hosted locally.

Final thoughts on edge resilience

Building a high-availability architecture with dual-WAN and local BGP transforms the stability of operations that previously suffered from sudden link drops. Although it requires hardware with higher processing power and refined technical skills in the infrastructure team, operational gains outweigh the initial effort. Keeping redundancies active and regularly tested ensures the business keeps running without unwanted interruptions, shielding the company against unpredictable carrier failures.