WAN and Internet Failover

In Kenya, internet outages are not rare. They happen.

Safaricom Fibre is reliable, but not infallible. Equipment fails, fiber lines cut, and routing problems occur. When your only internet connection is a single Safaricom link and it goes down, your entire business stops. Phones go silent, email stops, cloud applications become inaccessible, and staff sit idle waiting for IT to fix something that's beyond their control.

The solution is failover: a second internet connection from a different ISP that takes over automatically if the primary fails. In Nairobi's context, that's typically a Safaricom fibre primary plus an Airtel fibre or 4G backup. Failover happens in seconds without manual intervention or staff knowing the primary link is down.

Dual-ISP architecture

Two internet connections require two physical lines from different ISPs. typically into the same location. Safaricom fibre is ideal as the primary connection: fast, stable, and widely available across Nairobi. Airtel fibre, Zuku, or 4G (Safaricom, Airtel, or Jamii) serves as the backup. Which backup you choose depends on availability and cost at your location.

Safaricom fibre primary

Safaricom fibre is the default primary connection in Nairobi. availability is good (most business areas have coverage), speed is competitive (typically 10 to 20 Mbps for business lines), and cost is reasonable. A Sentire managed IT client in Nairobi CBD or Upper Hill can likely get Safaricom fibre deployed within a week.

Airtel or 4G backup

If Airtel fibre is available at your location, it's a solid backup. bandwidth is similar to Safaricom, and having two fibre connections is ideal because they're unlikely to fail simultaneously. If fibre isn't available for a backup, 4G is the fallback. 4G latency is higher than fibre, but for keeping the office online during a primary outage, it's sufficient. A 4G backup also has the advantage of working if the problem is at your premises (a breaker trip or cable damage) rather than at the ISP.

How failover works

Both internet connections feed into your firewall (or a dedicated WAN failover appliance). The firewall monitors the health of both links continuously. If the primary connection fails to respond (tested every few seconds via heartbeat pings to external servers), the firewall instantly shifts all traffic to the backup. DNS is updated, routing tables are rewritten, and sessions are migrated. Most users experience a two- to five-second pause in connectivity. then everything continues working.

When the primary connection is restored, the firewall detects this and gradually shifts traffic back. You have the option to choose whether this happens automatically or waits for manual intervention. most clients prefer automatic: if the primary is restored and stable, it should carry the load again.

Load balancing for performance

While failover keeps you online when a connection fails, load balancing distributes traffic across both connections during normal operation. If both your Safaricom and Airtel links are available, one connection carries half the traffic and the other carries the other half. this uses your available bandwidth more efficiently and often improves performance during peak hours when one link alone would be congested.

Load balancing policies can be weighted. you might send 70% of traffic to the faster Safaricom connection and 30% to the backup, or balance equally depending on your preference and link speeds.

Managed monitoring

As part of Sentire's Managed IT Support, dual-ISP failover is monitored 24/7. We track the health of both connections, detect failures, and verify that failover is working correctly. If there's an issue with one circuit, you'll likely hear from us before you notice the problem. We also review failover logs monthly to ensure the configuration is optimal for your traffic patterns.