Redundancy Shopping on a Credit Union Budget
Cedar Falls Credit Union operates one branch with 45 employees. Teller transactions depend on a cloud core-banking platform, and all staff use Microsoft 365. The branch has a single 300/300 Mbps fiber circuit at $650 per month with a 99.5% SLA; in the past year there were three outages totaling nine hours. Quotes on the table: a second fiber circuit from a different carrier at $1,100 per month on an 18-month term; a fixed-wireless 100/20 Mbps link at $300 per month with no term; and a 5G failover router at $150 plus $40 per month for data. The board wants no more than 15 minutes of unplanned downtime per incident and has asked for a recommendation with a cost justification before the next meeting.
1. Evaluate the three options against the 15-minute target and the outage history, and make a recommendation with cost justification.
Read the worked answer
Start with the SLA arithmetic. 99.5% availability permits 0.5% × 8,760 h = ≈43.8 hours of downtime per year. The branch experienced 9 hours. The carrier owes nothing, and the SLA provides almost no protection against the stated target. A 15-minute-per-incident goal is an engineering requirement, not a contract requirement.
Costs.
- Second fiber: $1,100 × 12 = $13,200/yr, $19,800 committed over 18 months.
- Fixed wireless: $300 × 12 = $3,600/yr, no term.
- 5G: $150 one-time + $40 × 12 = $630 in year one, no term.
Judgment. None of these alone meets the target - the 15-minute goal is met by automatic failover, not by owning a second circuit. But the cheapest path to automatic failover is the 5G or fixed-wireless link plus a dual-WAN firewall. At $630–$3,600/yr versus $13,200/yr, that is 4× to 20× cheaper than the second fiber, with no multi-year commitment while the root cause is still unknown. The 100/20 fixed-wireless upload may be tight for the teller platform; 5G's variable throughput and CGNAT may break IP allowlisting with the core-banking vendor - both need verification before purchase.
Recommendation: approve the 5G failover now as an immediate, low-risk stopgap; pursue fixed wireless as the durable diverse path if the upload and IP requirements check out; defer the second fiber until the outage causes are known.
2. Describe the network and power configuration changes required to actually deliver automatic failover - not just a second cable.
Read the worked answer
Routing and failover
- A dual-WAN firewall or small SD-WAN appliance with health checks to multiple targets (the core-banking host, a public DNS resolver, a public IP) - not just a ping to the ISP gateway, which stays up even when the ISP's upstream is down.
- Failure thresholds and a failback delay so a single dropped probe or a flapping link does not bounce the whole branch between paths.
- Policy-based routing: SaaS and VoIP prefer the primary WAN, everything else spills to the backup; test that the core-banking session survives the switch or fails gracefully.
Addressing and services
- NAT and a public IP on each WAN; if the core-banking vendor or any site-to-site VPN uses IP allowlisting, register both IPs now.
- DNS resolvers reachable over both paths; a resolver tied to one ISP becomes an outage of its own.
- Confirm whether VoIP/SIP re-registers cleanly after a WAN change.
Power and hardware
- UPS sized for the firewall, core switch, and both WAN terminations (ONT and radio/5G modem), with runtime matched to the observed outage length.
- One of the historical failures was hardware, so keep a spare firewall or an HA pair.
Operations
- Alerting on WAN state changes, a documented manual override, and quarterly failover drills with a stopwatch - the 15-minute target is only real if it has been measured.
3. New information: the nine hours broke down as eight hours from a contractor cutting the conduit during parking-lot work, and one hour from a failed power supply in the branch router. Does that change your recommendation? Justify.
Read the worked answer
Yes - it changes the shape of the solution, though not the direction.
The conduit cut is a correlated-failure problem. A second fiber circuit from a different carrier is only genuinely diverse if it enters the building by a physically separate route. Carriers frequently lease the same duct, and 'different carrier' says nothing about the trench. A second fiber in the same conduit would have failed at the same moment and would have cost $13,200/yr to deliver zero additional protection in the only scenario that actually occurred. Fixed wireless or 5G is diverse by medium, not just by vendor.
The router power-supply failure is not an ISP problem at all. No circuit purchase fixes it. It argues for a UPS, a spare device, or an HA pair - a few hundred dollars, not a five-figure contract.
Revised recommendation:
- Immediate: 5G failover + dual-WAN appliance + UPS and spare hardware (well under $2,000 in year one).
- Near-term: fixed wireless as the durable diverse path, contract-free.
- Second fiber only if the provider can document a physically separate entry path and the budget allows - and even then it addresses a risk that has not occurred in the last year.
The general principle: redundancy must be independent of the failure mode, and the failure history is the best guide to which failure modes matter.