How can I use managed satellite broadband services to provide backup internet for a network outage at a remote office?

Managed satellite broadband can work well as a backup internet link for a remote office, especially where terrestrial circuits are unreliable or slow to restore. The basic idea is to keep your normal WAN as primary, and have a satellite service ready to take over when that link fails.

Typical setup

1. Primary connection

   • Fiber, cable, DSL, microwave, or MPLS as the main internet path.

2. Managed satellite backup

   • A satellite provider installs and manages the dish, modem, and service.
   • The office router/firewall is configured with satellite as a failover WAN.

3. Automatic failover

   • If the primary link goes down, traffic automatically switches to the satellite link.
   • When the primary comes back, traffic switches back, either automatically or after validation.

---

What “managed” gives you

A managed satellite broadband service usually includes:

• Hardware installation and maintenance
• Service monitoring
• Network operations support
• Bandwidth planning
• Service-level agreements
• Remote diagnostics and troubleshooting

This is helpful because satellite links can be more complex to deploy and tune than a simple consumer backup connection.

---

How to design it

1. Define what must stay online

Satellite backup has limited bandwidth compared with typical wired service, so prioritize:

• VPN access
• Email
• VoIP for critical calls
• ERP / POS / ticketing systems
• Remote admin access

Avoid using it for:

• Large file syncs
• Video conferencing unless necessary
• Cloud backups
• General web browsing for all users

2. Choose the right satellite service

Ask the provider about:

• Latency
  • GEO satellite has high latency; LEO is much lower.
• Bandwidth
  • Enough for essential operations, not full office usage.
• Data caps / fair-use policies
• Failover readiness
  • Some managed services are better optimized for backup than continuous primary use.
• Static IP support
  • Useful for VPNs, remote access, or whitelisted services.

3. Put a failover-capable router/firewall in place

Your edge device should support:

• Dual WAN
• Health checks
• Automatic failover and failback
• Policy-based routing, if needed
• VPN persistence over link changes

Common practice:

• Primary WAN on interface 1
• Satellite modem on interface 2
• Router continuously pings a reliable endpoint to detect outage

4. Tune traffic during failover

When satellite becomes active:

• Restrict bandwidth-heavy apps
• Enable QoS for critical traffic
• Optionally block nonessential traffic
• Notify users that backup mode is active

5. Test regularly

A backup link is only useful if it works when needed. Test:

• Link failover
• DNS behavior
• VPN reconnection
• Voice quality
• Application access
• Recovery back to primary

---

Key considerations

Latency

Satellite, especially GEO, has much higher latency than terrestrial internet. That can affect:

• Interactive apps
• RDP/VDI
• Voice and video
• Some VPN performance

Weather and line-of-sight

Satellite service can be affected by:

• Heavy rain or storms
• Obstructions like trees or buildings
• Poor antenna placement

Power resilience

If you want true backup connectivity, also ensure:

• Router, modem, and dish power are on UPS
• Site has generator support if outages are common

Security

• Use encrypted VPN tunnels
• Keep firewall rules tight
• Limit management access
• Verify the provider’s network architecture and compliance needs

---

Example use case

A remote branch uses a fiber circuit as primary internet. The branch installs a managed satellite broadband service as backup. The firewall checks the fiber link every few seconds. If the fiber fails, the firewall:

• Sends all critical traffic over satellite
• Restricts nonessential traffic
• Keeps the site connected for email, cloud apps, and support tools

Once fiber is restored and stable, the firewall moves traffic back automatically.

---

Best practice summary

• Use satellite as backup, not the main link, unless no terrestrial service is available.
• Pick a provider with managed installation, monitoring, and support.
• Use a dual-WAN router/firewall with automatic failover.
• Reserve satellite for critical business traffic only.
• Test the setup regularly and include power backup.

If you want, I can also give you:

1. a reference architecture diagram,
2. a vendor selection checklist, or
3. a step-by-step failover configuration example for a specific firewall brand.