Satellite
Designing a hub and spoke that tolerates outages
Applies to Any platform Satellite / VSAT This applies to any hub-and-spoke WAN, satellite networks above all; the design points are independent of vendor or operating system.
In a hub-and-spoke network, remote sites depend on a central site for almost everything. That is efficient and it means a link outage stops all work at that site — unless the design anticipates it.
What should survive locally
Work through what a user at a remote site does in a day and ask which of those needs the hub.
Authentication. A cached credential or a read-only local directory replica means people can still log in. Without it, a link outage means nobody can start work at all.
DNS. A local resolver with a cache means local services stay reachable by name. It also removes a round trip from every single user action, which on a high-latency link is worth having regardless.
Local services. Printing, file access for recent work, and the site’s own systems should not traverse the link. If the printer is in the same room, the print job should not cross a satellite.
Graceful degradation
Applications should fail usefully. An application that queues work and synchronises later keeps a site productive through an outage. One that shows a spinner forever does not, and the difference is a design decision made long before deployment.
The hub is a single point of failure
Everything depends on it, so it needs the redundancy the spokes do not: dual power, dual links, and a tested failover. It is worth being precise about what “tested” means — a documented exercise where the primary was actually taken down, not a belief that it would work.
Out-of-band access
When a remote site’s link fails, you cannot reach it to diagnose why. A cheap independent path — a cellular modem on a console server — turns a site visit into a remote fix. On sites that are hours away, it pays for itself the first time it is used.
Monitor from both directions
Monitoring only from the hub tells you a site is unreachable, which you knew. Something at the site that records its own view — link statistics, local reachability — gives you the evidence to tell the provider what happened, rather than asking them what happened.
Related reading