You can buy Circuit A from one carrier and Circuit B from another, terminate them on separate routers and still lose both to the same excavator. The expensive mistake is assuming two carrier names automatically mean two physical routes.
| Setup | Looks Diverse | Actual Protection |
|---|---|---|
| Two ISPs, same conduit | Yes | Weak against excavation |
| Separate entrances, shared street manhole | Very much | Still one local failure point |
| Separate conduits and street routes | Yes | Strong local diversity |
| Separate routes, hubs and entrances | Yes | Much stronger end-to-end resilience |
This is the classic failure. The fibers are technically separate, but one directional drill can damage the entire duct bank. Extra fiber inside that conduit does not create geographic diversity.
The company on the invoice may not own the access fiber into your building. Ask each provider who actually supplies the local loop. Two national carriers can purchase access from the same underlying network.
North-wall and south-wall entrances sound excellent until both routes meet in the same street manhole fifty yards away. Entrance diversity protects only the portion that is actually separate.
Aerial routes have their own version of the shared-conduit problem. Different carrier cables attached to the same poles can both disappear when a vehicle, storm or utility incident takes out the pole line.
Street-level diversity is valuable, but critical sites should also ask whether both connections feed the same carrier hub, central office, POP or aggregation location. Physical-path and node diversity are separate design choices.
Bridges, tunnels, railroad corridors and major utility rights-of-way naturally concentrate infrastructure. Two routes that look widely separated on either side can still share one vulnerable crossing.
Two outside routes can enter independently and then share one riser, telecom closet or cable tray on the way to the server room. A fire, water event or construction accident inside the property can still remove both.
Perfect outside-plant diversity can still end at one failed router, firewall, switch or power supply. Carrier resilience and customer-premises resilience have to be designed together.
A healthy backup circuit is useless if BGP, SD-WAN, VPNs, firewall rules, DNS or cloud allowlists do not move cleanly during failure. Controlled outage testing belongs in the diversity plan.
Carrier engineering may be able to confirm route separation without handing over every sensitive network detail.
Who physically owns each access circuit?
Do the fibers reach different sides of the property?
Are conduit, pole and major street segments physically separate?
Is diversity engineered and documented or merely best effort?
Current Lumen guidance describes protected routing as automatic failover after a path failure, while diverse routing keeps paths from sharing the same physical infrastructure.
Verizon likewise offers protected Dedicated E-Line configurations with full local-loop fiber-path diversity while noting that unprotected circuits do not guarantee local-loop path diversity. That is a useful reminder that “dedicated” does not automatically mean “diverse.”
| Business Exposure | Practical Target |
|---|---|
| Normal office productivity | Primary fiber plus independent 5G may be enough |
| Cloud-heavy business | Two providers plus verified local-path separation |
| Manufacturing, call center or major e-commerce | Separate routes, automated failover and resilient edge equipment |
| Hospital, financial or critical infrastructure | Separate entrances, routes, nodes, power and tertiary connectivity where appropriate |
Unknown answers score as unresolved risk. That is intentional. Unverified diversity should not be treated the same as engineered diversity.
