When IPsec drops, a spare route is not a fallback policy

A site loses its tunnel, and the route table still shows a perfectly usable path to the destination through the internet. Somebody proposes failing over to it and calls the change a routing fix. The packet could travel that way; the question nobody asked is whether it is allowed to arrive without protection. Those are different answers from different tables, and mixing them up is how an outage becomes an incident.

Two outcomes that look identical in a route table

Reachability says a packet has somewhere to go. A security policy says what must happen to that packet on the way, and the two are enforced by different machinery. A route can exist for a flow that the policy is required to drop, and that combination is not a misconfiguration. Separating the two questions is what makes an outage plan reviewable at all.

So an outage path is only a design after somebody decides which of the permitted outcomes applies. Until that decision exists, the spare route is a temptation rather than a plan.

The policy model has three verdicts, not two

The IPsec architecture separates traffic that must be discarded, traffic allowed to bypass protection, and traffic that must be protected. Those are three distinct instructions, and the middle one is a deliberate exemption rather than a failure mode. Reading them as a pair is what produces the false choice between a tunnel and an open road.

A missing association does not silently promote a protect rule into a bypass. The policy still says protect, so the packet waits or dies, and that behaviour is the control working as written, not evidence that the policy is broken.

Write the requirement for your flow as one of three sentences: stop until a protected path exists, switch to another protected path, or use a path that is separately authorized to run without IPsec. Only the third changes the security contract, and it needs an owner who can sign it. That sentence goes in the change record, not in someone's memory. Reviewers approve the second sentence and refuse the third, and both decisions are reasonable when they are visible.

A bypass is a contract both endpoints sign

An alternative path needs routable addresses, explicit admission where it arrives and a reply path that works in both directions. Private site addresses do not become reachable because a default route points somewhere.

Authentication matters as much as addressing. Traffic that skips the tunnel and arrives at a boundary expecting protection gets rejected even when it lands on the right interface, so the receiving policy has to accept that shape on purpose. An exemption that the far end never agreed to is an outage with extra steps.

Removing a selector or loosening a map to make the fallback work is not a controlled exemption. It broadens what is exempt, leaves the far end enforcing something different, and can change which translation rule matches the flow.

Translation and admission change the arithmetic

Translation can present another address view, but the forward and reverse mappings have to agree with the alternative path. A one-way mapping produces a connection that opens and then hangs. Half a mapping is worse than none, because it looks like progress.

Admission is the second half. The receiving side must have an explicit rule for this traffic, its own logging, and a way to tell an approved exemption from a mistake at three in the morning.

Restoration belongs in the design

Record how the failure is detected, which policy picks the replacement and what happens to sessions that were running when it happened. A new connection can succeed after failover while an older one keeps state tied to an address that no longer applies.

Prefer another protected path whenever the requirement is continuous protection. Where an unprotected exception is genuinely necessary, bound it by sources, destinations, services and a duration, and write down how it gets withdrawn.

Test both states, not just the outage

Acceptance covers the failed-tunnel case and the restored one, with an application check on each. The interesting result is not that packets kept moving, but that they moved only under the contract the organisation chose.

Add the withdrawal test as well. An exception that nobody can turn off has quietly become permanent policy, which is exactly what the original rule was protecting against. Put an expiry and a named reviewer on it, or the exemption outlives everyone who understood it.