OpenCyber AcademyLesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Availability model"]
N2["Lab — Redundant tunnels"]
N3["32.2 Reading the model"]
N4["32.3 Independence"]
N5["Failover design"]
N6["Main office redundancy"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Availability model"]
N2["Lab — Redundant tunnels"]
N3["32.2 Reading the model"]
N4["32.3 Independence"]
N5["Failover design"]
N6["Main office redundancy"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Availability model]
|
v
[Lab — Redundant tunnels]
|
v
[32.2 Reading the model]
|
v
[32.3 Independence]
|
v
[Failover design]
|
v
[Main office redundancy]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) model availability; (2) design redundancy; (3) test failover.
32.1 Availability model
A single tunnel with 99.5 percent availability gives about 44 hours of downtime a year.
An availability model estimates the share of time a service can be reached, combining the availability of each component it depends on. Components in series multiply, so a chain of many parts is less available than any one of them; redundant parallel components improve availability. The model shows where a single failure would cut off an office.
Inputs such as failure and repair times come from records or vendor data, stated as assumptions.
Lab — Redundant tunnels
"""Availability of a site's VPN with one vs two independent tunnels (synthetic, stdlib only)."""
a = 0.995
for n in (1, 2):
av = 1 - (1 - a) ** n
print(f"tunnels {n}: availability {av:.6f}; expected downtime {(1-av)*8760:.2f} h/year")
Run with python3 lab_avail.py. Verified output:
tunnels 1: availability 0.995000; expected downtime 43.80 h/year
tunnels 2: availability 0.999975; expected downtime 0.22 h/year
32.2 Reading the model
Two independent tunnels raise availability to 99.9975 percent, about 13 minutes a year, assuming independent failures.
Reading the model, Kofi identifies the components that contribute most to downtime and the single points of failure. These become candidates for redundancy, while components with little effect do not justify extra spending. He reports results with assumptions stated, such as estimated failure and repair times.
Results are best presented as expected hours of downtime per year, which managers grasp more easily than percentages such as 99.9. The model is then used to compare options, such as a second internet link, by showing how much downtime each would remove relative to its cost.
32.3 Independence
Independence requires different providers or paths. Kofi recommends a second link from a different provider at the three largest offices.
Redundancy only helps if failures are independent. Two links through the same duct, or two firewalls on the same power circuit, can fail together. Engineers check for shared causes and record them, because the simple model overstates availability when components share dependencies.
Where dependence cannot be removed, the risk is stated honestly. For example, if both main office links leave the building through one duct, a single excavation can cut both, and the report should say so even if the numerical model suggests high availability.
Failover design
Redundant links help only if traffic moves to the surviving link quickly. Kofi configures tunnel monitoring so the branch firewall detects a dead tunnel within twenty seconds and routes traffic through the second tunnel. The requirement R6 sets a sixty-second limit for failover. He tests failover in the lab by disabling one link and timing recovery, and later repeats the test at one branch in an approved window, recording the times as evidence. Failover is retested after any change to tunnel or routing configuration, because small changes can slow detection.
Main office redundancy
The main office firewall carries all inter-office traffic, so it is deployed as an active-standby pair. If the active unit fails, the standby takes over with existing connections preserved. Firmware updates are applied to the standby first, then roles are swapped, avoiding downtime. Kofi documents the pair's health checks and the alert raised when one unit is unavailable, so the team knows when redundancy is temporarily lost. The pair is tested twice a year by deliberately failing the active unit during an approved maintenance window and timing the switch.
Limits of the model
The availability model assumes failures are independent and that failover is instant. In reality, both providers might share a road where cables run, and failover takes up to sixty seconds. Kofi states these limits next to the figures and asks providers for route information where possible. The model is a guide to decisions, not a guarantee, and presenting its assumptions keeps managers' expectations realistic. Where providers cannot supply route information, the risk of a shared path is recorded as an open assumption. The figures are recalculated once real outage data for a full year becomes available.
Worked example
The council funds second links at three offices.
Synthetic case. Figures are synthetic.
Errors and limits
Two links in the same duct are not independent.
Exercises
- EX094 — Downtime calculation. Compute downtime for 99.5% availability.
Show marking criteria
Rubric: 3 = 43.8 h;; 2 = value;; 1 = vague;; 0 = none. - EX095 — Redundant result. What does the lab give for two tunnels?
Show marking criteria
Rubric: 3 = 0.999975, 0.22 h;; 2 = value;; 1 = vague;; 0 = none. - EX096 — Independence condition. What makes tunnels independent?
Show marking criteria
Rubric: 3 = different providers and paths;; 2 = different;; 1 = vague;; 0 = none.
Synthesis
Redundancy dramatically improves availability when failures are independent.
Continue studying — chapter 32 of 50
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →