WAN aggregation combines two or more internet links, such as fiber, cable and cellular, so a site can use them together for more capacity and better resilience. Failover only moves traffic to a backup link after the main one fails. Aggregation needs a way to split and rejoin traffic, which adds security work.
Why is combining links harder than it sounds?
Ordinary TCP uses one path per connection. The Multipath TCP specification, RFC 8684, opens with exactly this point: TCP/IP communication is restricted to a single path per connection, yet multiple paths often exist between peers. Using them together, it says, can improve resource usage and user experience through higher throughput and resilience to network failure.
That is the core of the problem. Your office may have two links, but a single download only ever uses one of them unless something is done. Different links also have different delay and loss, so packets sent over both can arrive out of order, and a receiver has to put them back.
What are the main approaches?
There are three families, and products often mix them.
Load balancing sends different connections over different links. A video call goes over link A while a backup job uses link B. Each connection still sees one path, so no single flow is faster, but the total is higher.
Failover keeps a backup idle until the primary stops working. It is the simplest and the cheapest to reason about, and it protects against outages, not against slowness.
True aggregation, sometimes called bonding, splits one flow across several links and reassembles it at a remote endpoint. This needs a device or service on the far side. Multipath TCP is the standards route for doing it at the transport layer when both endpoints support it. RFC 8684 specifies version 1 and says it provides the same service to applications as TCP, a reliable bytestream, over multiple flows that may be across disjoint paths.
What changes for security?
First, the remote endpoint that rejoins traffic sees everything. If a provider's aggregation point terminates your tunnels, they can read what is not encrypted end to end. Encrypt inside the tunnel and know who operates the far end.
Second, an extra path is an extra attack surface. A cellular backup with a public address and default credentials is a common blind spot. Apply the same firewall policy to every link, not only the main one.
Third, inspection can break. If a stateful firewall sees half of a flow on one link and half on another, it may drop traffic it cannot match to a session. Keep the firewall where all paths converge, or make sure session state is shared.
Fourth, logging. When one session crosses three links, logs from each link tell only part of the story. Record the flow at the point where it rejoins.
A constructed example
A clinic has a 300 Mbps cable line and a 50 Mbps fixed wireless link. The manager wants to use both for a cloud backup that currently crawls. A simple load balancer gives no benefit, because the backup is one long connection and stays on the cable line. The team has two options: send the backup as several parallel connections, which a balancer can spread, or add an aggregation service that bonds the links. They pick parallel connections first, because it needs no new device and no new party who can see traffic, and keep failover for the voice system.
How to check or apply this
- Write down what you need: more throughput, fewer outages, or both. Failover alone answers the second.
- Check whether your biggest flows are single connections. If so, load balancing will not speed them up.
- If you use an aggregation service, find out who runs the far endpoint and what they can see. Encrypt traffic end to end.
- Apply one firewall policy to every link, including cellular backups.
- Place stateful inspection where traffic converges, and test a failover during a quiet hour.
- Monitor loss and delay per link so you notice when one degrades.
Quick check
Does WAN aggregation double my speed?
Only if one flow can be split across links, or if your traffic is many parallel connections. A single connection on a plain load balancer stays on one link.
Is failover enough?
For outages, often yes. It does not add capacity during normal operation.
Sources
- RFC 8684, TCP Extensions for Multipath Operation with Multiple Addresses
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
Last reviewed: 18 October 2026.
