Dual WAN Failover Not Working? Causes and Fixes

What failover should do

Dual WAN failover is a router feature that moves your internet traffic to a backup connection when the primary WAN stops working. It is not the same as load balancing. Failover keeps the network alive when the first connection fails; load balancing splits traffic across both connections the whole time. If your router never switches, start by confirming which mode you enabled. See dual WAN explained and load balancing vs. failover.

Failover is also different from a link aggregation group. Link aggregation combines two Ethernet ports into one logical link, but both ports must lead to the same destination. Dual WAN failover uses two separate internet connections, so the backup can still work when the first ISP is down. For more, see dual WAN vs. link aggregation.

Check how the router detects an outage

The most common reason failover does not trigger is that the router never sees the outage. A router can detect a WAN failure in several ways. The simplest method watches the physical link: if the Ethernet cable is unplugged or the carrier signal disappears, it knows the WAN is down. But an ISP outage often leaves the modem or ONT looking connected. The router sees the cable is up, so it keeps trying to use that WAN.

Look for a setting called WAN detection, internet detection, health check, or ping probe. If it is set to link state or carrier detection, change it to a connectivity check when your router supports it. You may also need to enter a test address; a common choice is a public DNS server, but any reliable external address can work.

• Link detection only works for physical disconnects.
• Internet health checks send a probe to an external server and mark the WAN down when replies stop.
• If your router only supports link detection, a secondary WAN may never take over during an ISP outage.
• Check the router logs to see what the WAN status was at the time of the outage.

Check priorities and failover mode

Even after the router detects the outage, the priority policy may keep all traffic on the primary WAN. Some routers call this active/passive: the primary WAN is always preferred, and the secondary is held as a standby. If the router does not mark the primary as failed, the secondary will not carry traffic. In active/active load balancing, both connections are normally used, but a failure can still leave sessions on the primary until their timers expire.

Check the WAN priority or failover order. Lower numbers usually mean higher priority, but some interfaces use a first, second, third list. Make sure the backup WAN is set to a lower priority or listed after the primary. Also check whether you have enabled preference for sticky sessions; that setting can keep current connections on the original WAN even after failover. See load balancing vs. failover for more detail.

• Primary WAN is not marked down.
• Priority order is reversed.
• Failover mode is disabled and load balancing is not being used.
• Existing sessions remain pinned to the old connection.

Confirm the secondary WAN is ready

Sometimes the secondary WAN is simply not ready. The backup port may be connected to a modem that is off, a cable may be loose, or the router may be using the wrong port for the backup. If the secondary connection is a cellular modem, check that the SIM is active, the data plan allows traffic, and the router recognizes the modem. See 4G and 5G routers explained and WAN port types.

Many routers show a status page with the IP address, link state, and registration time for each WAN. If the secondary WAN shows no address or an idle link, the connection is not ready to take over. Reseat the cable, reboot the modem, and confirm the connection type. The secondary WAN may need DHCP, PPPoE, or another login that you have not configured.

If the backup modem is in bridge mode, it must pass the public connection through to the router. Misconfigured bridge mode often makes the router see a link but no internet. See bridge mode explained.

• The backup cable is not secure in the WAN port.
• The secondary modem is powered off or has no signal.
• The SIM card in a cellular modem is inactive or out of data.
• The secondary WAN is set to the wrong connection type.
• The router's status page shows no IP address for the backup WAN.

Review firmware and router logs

Router firmware controls how WAN detection and failover work. An outdated or buggy release may fail to switch even when all cable and modem settings look correct. Check the manufacturer's support page for your model and compare the installed version with the latest release. Update in a controlled way, and note any settings that may be reset. See router firmware updates explained and how to update router firmware.

Router logs can tell you whether the router saw the outage. Look for entries for WAN link down, internet detection failed, or failover triggered. If the log shows nothing, the router did not detect the failure. If it shows the backup WAN was down, the issue is on the backup side. Most routers have a status page or log viewer under the administration section; see how to read router logs.

After updating, verify that the router's wireless security settings still meet current standards. Wi-Fi Alliance notes that WPA3 is mandatory for Wi-Fi CERTIFIED devices and requires Protected Management Frames. See the Wi-Fi Alliance security resources listed in the sources.

Inspect cables, modems and power

Failover can also fail because the physical path is interrupted. Swap the Ethernet cable between the modem and router, try a different port on the router, and check power adapters on both modems. If you have an ONT for fiber service, confirm its power and optical light are normal. For a cable connection, check whether the modem is still online from its own status page.

A power outage can make both the primary modem and the backup modem reboot at different times. If the backup modem takes a long time to register on its network, the router may mark it as unavailable and keep traffic on the primary. Give the backup a few minutes after power is restored before testing failover again.

For general security practices, NIST develops cybersecurity and privacy standards and guidelines that can help you keep your network safe. See the NIST cybersecurity and small business resources listed in the sources.

What to pick for your use

Questions

Why won't dual WAN failover switch when the primary internet goes down?

Most often the router does not see an outage. A physical link check only reports whether the cable is connected, not whether the ISP is actually providing internet. Enable a connectivity probe if your router offers one and confirm the backup WAN is marked ready.

Does a second WAN require a special port or cable?

No. Most consumer routers use the same Ethernet WAN ports for either connection, while some models accept a USB cellular modem. Check the router's port labels and status page; the backup port must be connected to a modem that has its own link to the internet.

Can a cellular hotspot be used as the failover connection?

Yes, if the router supports a USB or Ethernet cellular modem and the connection type is configured correctly. A phone's hotspot is less reliable than a dedicated modem because the phone may change networks or sleep; use a battery-backed modem for a more consistent backup.

Should I update the router firmware to fix failover?

Firmware updates often change WAN detection and dual WAN behavior. Check the manufacturer's support page for your model and follow the router's update procedure. See router firmware updates explained before updating.

Will failover keep an active video call running?

No. A failover switch changes the external IP address and may force existing sessions to reconnect. Video calls, downloads, and VPN sessions usually drop for a few seconds, and some services require you to reconnect. Failover is meant to restore internet access, not preserve every live session.