Branch Connectivity Redundancy: What Happens When the VPN Drops?

In multi-site businesses, the most critical yet least discussed piece of the network is the VPN tunnel binding each branch to head office. While it works, nobody remembers it exists; the moment it drops, branch staff cannot open the ERP, shared folders vanish, and the barcode and sales applications served from head office stop answering. The branch says "we have internet but nothing works" — because the problem is not the internet, it is the encrypted bridge between two points.

How a Branch VPN Works, and Why It Drops

The standard for permanent branch connectivity is a site-to-site IPsec tunnel between two firewalls. The tunnel stays up through a continuous handshake between the endpoints, and typically drops for one of three reasons:

• Line outage: the branch's or head office's internet goes down — the most common cause, and not a VPN problem in itself.
• IP change: on lines without static IPs, the ISP's address renewal drops the tunnel; one endpoint keeps looking for the other at the old address.
• Endpoint device issues: a rebooted modem, an updated firewall or a carelessly touched rule can silently tear the tunnel down.

The distinction matters because the remedies differ: backup lines answer outages, static IPs or dynamic DNS answer address changes, and monitoring plus change discipline answer device-side drops.

What Stops When the Tunnel Is Down

System	When the tunnel drops	Business impact
ERP/accounting at head office	Unreachable from the branch	Sales and invoicing stop
Shared file server	Mapped drives disconnect	Documents unreachable, save errors
IP PBX internal lines	Branch–HQ extension calls fail	Communication shifts to mobile phones
Central camera monitoring	Branch cameras invisible from HQ	Local recording continues, live oversight lost
Cloud applications	Unaffected	Keep working if branch internet is up

The last row is a critical diagnostic: if cloud apps work while internal systems are unreachable, the fault is almost certainly the tunnel, not the internet — one sentence that shortens every support call.

Three Redundancy Patterns

Pattern 1: a Second WAN at the Branch

Add a backup line to the branch firewall in a standard failover arrangement; the tunnel re-establishes automatically over the backup when the primary drops. Since the branch line is the most common point of failure, this is the right first investment when budget allows only one.

Pattern 2: Dual Endpoints at Head Office

Every branch terminates at one head office; if the head-office line drops, all branches drop at once. The second step is therefore dual WAN at head office, with branch devices configured to know both head-office addresses. Because head office is the heart of the topology, many estates rightly prioritise this pattern even before the first.

Pattern 3: Full Mesh

With dual lines at both ends there are four possible paths, and the tunnel builds over whichever is alive. This is the target for branches carrying critical operations — warehouse dispatch, high-volume sales floors. When branch count and management complexity grow beyond this, the conversation naturally evolves toward SD-WAN, which manages the same mesh through central policy.

The Three Settings of Automatic Recovery

• Dead-peer detection (DPD): endpoints verify each other's liveness with periodic signals; when signals stop, the tunnel is declared dead and rebuilt. With DPD off, one side can consider the tunnel "up" for hours after it has died.
• Persistent start: the tunnel should rebuild itself without waiting for traffic. Otherwise the bridge is not up until the first user opens the ERP in the morning — and the day starts with "the system is down".
• Address flexibility: for the tunnel to rebuild from a new source address after failover, both ends need the counterpart definitions ready (backup peer addresses, dynamic DNS). This is the branch-office version of the classic static-IP trap.

Monitoring: Who Reports the Dropped Tunnel?

In a healthy setup, the monitoring system announces the dropped tunnel — not a branch user. Tunnel state and branch endpoint devices go into monitoring; a drop triggers an alert to IT and the recovery time is logged. In multi-site estates, tunnel status belongs at the very top of the monitoring list.

What Yamanlar Bilişim Does for Multi-Site Estates

Branch connectivity projects start with a drawn topology: how many branches, which systems sit at head office, which lines exist, and where the single points of failure are. The redundancy pattern is proposed against that map; after installation the tunnels join monitoring, and drop-and-recover behaviour is verified with a controlled test. For maintenance-agreement customers, branch tunnel health is one of the standing items of the monthly checks.

FAQ