One policy
Backup is not a second, looser network.
Backup link
A branch on backup keeps the same policy it had on fiber.
When the fixed link fails, the router does not open a local internet “for a moment”. It raises a path through the private APN to headquarters.
ExampleExample: a bank branch or a public office. Fiber is primary, LTE/5G on the private APN waits as backup, and Starlink is added where coverage is weak. An illustrative scenario, not a client reference.
Central breakout
The internet, if any, sits behind the UTM/NGFW at headquarters.
A closed APN
For devices that do not need the internet, we do not add a route.
One policy on both paths
Classic LTE backup with a SIM “on the internet” walks around the central firewall. A different policy, a different log, a different exposure — exactly when the primary link is already down.
Peplink moves the WAN to a SIM on the private APN, or to Starlink bonded with SpeedFusion. The packet enters headquarters through the tunnel. It reaches the internet only through the firewall (filter, IPS, log), or not at all if the APN stays closed. When the fiber returns, traffic returns to the primary link.
Security
- No local NAT at the branch during the outage.
- The same rules and the same log as on the primary link.
- Hot Failover is the manufacturer’s description. We do not publish our own failover time and we do not promise that every application session survives without being set up again.
Continuity of a site and a single trace on the firewall are material for a conversation about incident handling and continuity. They do not close the statutory duty.
Peplink · SpeedFusion · InControl 2 Starlink How it works
Request a proposal APN types and connection types +48 698 355 667