A regional ISP's core network is the infrastructure that every subscriber depends on for every connection. A failure anywhere in the core is not a degraded experience for some subscribers: it is a complete outage for everyone the failed component serves. Core network redundancy is the design discipline of ensuring that no single component failure results in a total service loss.
The challenge is cost. Redundancy means duplicate infrastructure, which means duplicate cost. The design question is not "should we have redundancy?" but "which failure scenarios are worth protecting against, at what cost, and with what recovery time objective?"
The Failure Scenarios Worth Planning For
Not all failure scenarios have the same probability or the same blast radius. The practical list for a regional ISP:
Upstream link loss is the highest-probability failure with the largest blast radius. A single upstream connection to a single transit provider is a single point of failure for all subscriber internet access. Multi-homing with a second upstream provider eliminates this single point of failure at the cost of the second link and provider relationship.
Core router failure at the aggregation or edge layer takes down all subscribers connected through that router. Redundant routers with active-standby or active-active failover protect against this at the cost of a second router and the complexity of failover configuration.
Physical link failure between sites (fiber cut, wireless backhaul failure) is the most common single event and the hardest to fully protect against without dedicated standby links or diverse route paths.
Power failure at a critical site takes down everything at that site. Generator backup for primary sites and battery backup for secondary sites are the standard mitigations.
Multi-Homing for Upstream Redundancy
Multi-homing with BGP is covered in the BGP multihoming article on this site. From a redundancy design perspective, the key requirements are: two upstreams with physically diverse path to the transit provider (not both running through the same conduit or physical route), BGP configured with appropriate local preference so one upstream is preferred and the other provides failover, and BFD configured for sub-second failure detection rather than relying on BGP hold timer expiry.
The second upstream does not need to be a primary-grade link. A lower-cost secondary connection that provides failover capacity in the event of primary failure satisfies the redundancy objective without requiring the second link to be dimensioned for full-load traffic. If the primary carries 500 Mbps at peak and the secondary is a 200 Mbps link, you have failover capacity at reduced performance, which is better than no failover.
Core Router Redundancy with VRRP
VRRP (Virtual Router Redundancy Protocol) provides gateway failover for subscriber-facing interfaces. Two routers share a virtual IP address: one is the active master, one is the backup. Subscribers use the virtual IP as their gateway. If the master fails, the backup takes over the virtual IP within seconds without requiring any subscriber-side reconfiguration.
RouterOS supports VRRP natively. The configuration places one router as master (higher priority) and one as backup (lower priority), both advertising the same virtual IP on the subscriber-facing interface:
The VRRP configuration must be combined with the appropriate routing between the two routers. If the master's uplink fails but the master itself is still up, VRRP will not trigger a failover unless you've implemented tracking: VRRP priority reduction triggered by the uplink going down, so the backup's priority becomes higher than the degraded master's and it takes over the virtual IP.
IGP for Internal Redundancy
For networks with multiple internal routers and multiple paths between them, OSPF provides automatic route recalculation around failed links. If the direct path between two routers goes down, OSPF reconverges (typically in under a second with BFD for link failure detection and OSPF fast-hellos) and reroutes traffic through an alternate path.
For most regional ISPs, the internal routing topology is simple enough that OSPF is not required: two or three core routers with static routes and VRRP for gateway failover is manageable. OSPF becomes valuable when the number of routers and links reaches a point where maintaining consistent static route configurations across the network becomes error-prone.
Physical Path Diversity
The most common failure mode that defeats logical redundancy is physical path convergence: two supposedly independent links running through the same conduit, the same trench, or the same facility room. A construction crew cutting a trench severs both links simultaneously and the logical redundancy provides no protection.
Verify physical path diversity explicitly for all links you depend on for redundancy. For fiber links, trace the physical route: do both paths use different street routes? Do they enter the facility through different physical entry points? For wireless backhaul, do both paths use different towers? Path diversity at the physical layer is what converts logical redundancy from a diagram exercise into actual resilience.
For operators who need their core redundancy design to satisfy CTDISR-2025 Business Continuity Planning requirements, the RTO and RPO targets for subscriber connectivity need to be grounded in the actual failover characteristics of the network design. Business Continuity Planning covers the BCP design that documents and tests these failover capabilities. For core network design that incorporates redundancy from the ground up, Network Design & Optimization covers the full architecture engagement.