A router failover may look successful from the network layer: the virtual IP moves, the standby router becomes active, and reachability is restored within seconds.
But for the operations team, the story may be different.
An SSH session used for remote maintenance may be disconnected. A public service published through NAT may require users to reconnect. A long-lived outbound TCP session from a branch application may be reset. In a dual-WAN environment, return traffic may even leave through the wrong ISP path.
This is the gap between network reachability and business continuity.
Traditional router high availability often focuses on one outcome: when the primary router fails, the standby router takes over the virtual gateway address. But in real enterprise networks, moving a virtual IP address is not the same as preserving active business sessions.
This is why enterprise edge routers need to move beyond basic address availability and toward stateful session continuity.
Key takeaways
Traditional VRRP protects virtual IP availability, but it does not synchronize service session state by itself.
Dual-WAN enterprise gateways require coordinated failover across multiple WAN and LAN virtual IPs.
AsterNOS-VPP uses VRRP Sync Group to move related virtual IPs together.
HA Sync can synchronize supported runtime session state, including stateful packet inspection (SPI), NAT, and load-balancing (LB) sessions.
Dual-WAN validation covered both inbound static DNAT and outbound dynamic SNAT session continuity.
Why enterprise edge routers need stateful high availability
Enterprise branches, retail sites, factories, hospitals, campuses, and remote offices are hosting more local applications, IoT devices, and edge workloads.
As real-time analytics, AI inference, video processing, and industrial control move closer to the business site, the branch router becomes more than an Internet access device. It becomes part of the local application, remote operations, and security infrastructure.
This changes how customers evaluate an enterprise gateway. The key question is no longer only:
Can the network become reachable again after a link or device failure?
The more important question is:
Can active business sessions continue after the failure?
Traditional VRRP gateway redundancy is still useful and mature. But in modern dual-WAN architectures, basic VRRP alone may not be enough.
What problem does traditional VRRP leave unsolved?
VRRP provides a shared virtual IP address across multiple routers. Through a Master/Backup election process, it decides which router currently responds to that virtual IP.
For a simple LAN default gateway, this is a proven high availability mechanism.
However, a dual-WAN enterprise gateway often has multiple virtual IPs at the same time:
ISP-A WAN VIP
ISP-B WAN VIP
LAN Gateway VIP
If these VRRP instances operate independently, different virtual IPs may end up on different physical routers. For example:
Router-A owns ISP-A WAN VIP and LAN Gateway VIP
Router-B owns ISP-B WAN VIP
This makes return-path control, NAT handling, and service continuity more complex.
More importantly, VRRP itself only controls virtual IP ownership. It does not maintain service session state.
A traditional failover may therefore look like this:
Item | Result |
Virtual IP ownership | Moved to standby router |
Network reachability | Restored |
Service session state | Not synchronized by VRRP itself |
Existing connection | May need to be rebuilt |
To preserve active flows, the standby router must take over not only the virtual address, but also the runtime state required to process existing traffic.
What is stateful router failover?
Stateful router failover means that the standby router is prepared to continue processing supported existing sessions after it takes over the forwarding role.
For a NAT gateway, this requires more than a floating IP address. The standby router must also understand:
which WAN path the connection used;
which public address and port were mapped to which internal server;
which dynamic NAT port was assigned to an outbound session;
which stateful inspection or service-processing state is required to continue forwarding the flow.
In other words:
The virtual IP is only the visible identity. The session state is what allows the connection to continue.
AsterNOS-VPP is designed to extend HA from virtual IP failover to stateful forwarding continuity.
Three requirements for preserving sessions during router failover
To keep an active session available across two routers, the system must satisfy three conditions.
1. Multiple virtual IPs must move together
A dual-WAN gateway does not rely on just one virtual IP. It may use multiple WAN-side virtual addresses and one LAN-side virtual gateway.
If these virtual IPs fail over independently, the data path can become inconsistent. Traffic may enter through one router while the LAN gateway or return path is owned by another.
AsterNOS-VPP uses VRRP Sync Group to bind multiple VRRP instances into one logical failover group.
When a key member fails, the related virtual IPs move together, keeping the complete forwarding path on the same router.
2. The network identity must remain stable
For remote clients and servers, a TCP connection is identified by a stable set of IP addresses and ports.
If failover changes the public NAT address from the primary router’s physical address to the standby router’s physical address, the remote peer sees a different connection. The original session is likely to fail.
AsterNOS-VPP can use floating WAN virtual IPs for both public service publishing and dynamic outbound NAT. After failover, the external network continues to see the same public identity.
This provides the foundation for session continuity.
3. The standby router must inherit supported session state
The same virtual IP is not enough.
The standby router also needs the supported runtime state required to process the existing flow.
AsterNOS-VPP uses state tracking and a dedicated synchronization link to synchronize supported runtime session state between the HA routers.
HA Sync supports synchronization of SPI sessions, NAT sessions, and LB sessions, allowing the standby router to inherit the runtime state required for stateful inspection, address translation, and load-balancing services during failover.
Based on the SONiC and VPP integration architecture, AsterNOS-VPP combines modular network control and configuration with a software data plane, allowing routing, NAT, policy forwarding, and state tracking to work together on a unified platform.
On top of that foundation, VRRP Sync Group and HA Sync protect multiple virtual addresses and supported runtime sessions as one coordinated HA system.
Dual-WAN validation: topology and session behavior
To validate this design in a dual-WAN enterprise edge scenario, we used a topology with:
two routers;
two WAN networks;
two WAN virtual IPs;
one LAN gateway virtual IP;
one internal application server;
one dedicated session synchronization link.
The validation covered two session directions:
Inbound service access: a WAN-side client connects to an internal server through a public WAN VIP and static DNAT.
Outbound enterprise access: an internal application server initiates a connection to a WAN-side server through dynamic SNAT.
These two directions matter because static DNAT and dynamic SNAT create sessions through different paths.
During the test, Router-A initially owned the WAN and LAN virtual addresses, while Router-B operated as the standby router. We then simulated a key interface failure on the primary router.
After failover:
Router-B took over the WAN and LAN virtual gateways;
active SSH sessions experienced a brief traffic pause;
the sessions then resumed automatically;
the terminal did not receive a connection reset;
users did not need to re-enter credentials or establish a new SSH connection;
Router-B could also process new inbound and outbound sessions after takeover.
This does not mean the failover process has no traffic impact at all. Routing convergence, virtual address ownership changes, and forwarding updates may still introduce a short pause. The key result is that supported existing sessions can continue instead of forcing users to reconnect.
This stateful takeover model is especially valuable in enterprise edge environments where remote access, service publishing, and outbound application connectivity need to remain stable during local router failover.
Where does this architecture fit best?
AsterNOS-VPP stateful high availability is especially relevant in the following environments.
Dual-ISP enterprise edge
Two routers connect to two ISPs and provide highly available Internet access through coordinated WAN and LAN virtual IPs.
This is a common design for enterprises that require carrier diversity and local gateway redundancy.
Public service publishing
Organizations can publish internal services through public WAN VIPs, while keeping supported existing TCP sessions available during router failover.
Example services include:
SSH management access;
internal operation platforms;
HTTP/HTTPS API endpoints;
other TCP-based application services.
Load-balanced service delivery
For environments using local load balancing at the enterprise edge, HA Sync can synchronize supported LB session state.
This helps the standby router preserve service-processing continuity during failover, instead of only taking over the virtual IP address.
Branch and edge sites
Retail stores, factories, hospitals, campuses, and remote offices often have limited on-site IT support.
Reducing manual reconnection and session recovery can lower the operational impact of gateway failures.
System integrators and managed service providers
System integrators (SIs) and managed service providers (MSPs) can use standardized routing, NAT, VRRP, and HA mechanisms to build repeatable high availability designs for enterprise customers. This makes the solution easier to validate, document, deploy, and operate across multiple sites.
How does this relate to SD-WAN and SASE?
Stateful local router HA does not replace SD-WAN or SASE. They solve different layers of the enterprise connectivity problem.
SD-WAN and SASE focus on cross-site connectivity, centralized policy, cloud security, and application-aware path selection.
AsterNOS-VPP VRRP Sync Group and HA Sync focus on local router and interface failover at the enterprise site.
If local failover loses the runtime state required by active sessions, dependent applications, management sessions, service publishing, or upper-layer tunnels may need to reconnect. That can extend the business recovery process at the site.
A more resilient edge design should therefore combine intelligent WAN architecture with a reliable local forwarding foundation.
FAQ
Does VRRP alone preserve existing sessions?
No. VRRP handles virtual IP ownership. Preserving existing sessions requires synchronized runtime session state and a consistent forwarding path.
Why must multiple virtual IPs fail over together in a dual-WAN gateway?
A dual-WAN gateway may use multiple WAN VIPs and one LAN gateway VIP. These virtual IPs should fail over as one coordinated group so traffic does not enter through one router while the return path or LAN gateway belongs to another.
Why does dual-WAN stateful HA need policy-based return routing?
In a dual-WAN NAT design, return traffic must follow the correct WAN path for the original session. Policy-based routing helps keep traffic symmetric across ISP-A and ISP-B paths.
Is a synchronization link required for HA Sync?
Yes. HA Sync requires a dedicated synchronization connection between the two routers. This connection is used to exchange supported runtime session state before failover, helping the standby router inherit the state required to continue supported sessions after takeover.
Does stateful HA mean zero traffic interruption?
No. A brief traffic pause may still occur during failover. The goal is to allow supported existing sessions to continue without forcing users to reconnect.
What types of sessions were validated?
The validation covered continuous SSH-based TCP sessions for both inbound static DNAT and outbound dynamic SNAT scenarios.
Why this matters
Dual-WAN failover is not only about moving a gateway address. For enterprise edge sites, WAN VIPs, LAN gateway ownership, session state, and return-path control must work together.
AsterNOS-VPP combines VRRP Sync Group, HA Sync, NAT, SPI, LB session synchronization, and policy-based forwarding to help enterprise sites build a more resilient local forwarding foundation.
For organizations running dual-WAN branches, public service publishing, remote operations, load-balanced services, or edge applications, that difference can determine whether a failover is merely survivable — or operationally smooth.