The failure that hurts most
A jump server outage is not an ordinary service outage. It arrives at the worst possible moment, because the moment you most need administrative access is during an incident — and the incident may well be what took the gateway down.
Worse, the failure mode is recursive: you cannot log in to fix the thing that stops you logging in. Any design that does not have an answer to this has not been finished.
Deployment patterns
| Pattern | How it behaves | Trade-off |
|---|---|---|
| Active-passive | A standby node takes over on health-check failure | Simplest to reason about; sessions drop at failover |
| Active-active | Multiple nodes serve concurrently behind a load balancer | No capacity loss, but session state and recording storage must be shared |
| Per-site gateways | Each location runs its own, with policy replicated | Survives WAN loss; more nodes to keep at baseline |
| Cold standby | A built but powered-down node, restored from configuration | Cheapest; recovery measured in hours, which is often unacceptable |
What has to survive failover
Availability of the login page is the easy part. These are the pieces that get missed:
- The credential vault. If secrets live on one node, failover produces a gateway that authenticates operators and cannot connect them to anything.
- Recordings in flight. A session cut mid-stream should leave a sealed partial recording, not a corrupt file or a gap.
- The audit ledger. Hash-chained records must remain consistent across nodes, or the chain fractures and every subsequent verification fails.
- Approvals in flight. A pending request should not vanish because the node holding it went away.
- Policy. Entitlements must be identical on every node. A standby with stale authorisations grants access that was revoked last month.
The dependency chain nobody diagrams
Gateways depend on services that may themselves depend on the gateway to be administered. Draw this explicitly:
- Directory. If authentication requires a domain controller that is unreachable during a network incident, the gateway is down for that incident. Cache credentials or provide a local fallback for a defined emergency set.
- MFA provider. A cloud-hosted second factor makes internet loss an administrative outage. Hardware tokens validated locally remove that dependency.
- Time. Certificate validation, TOTP, and hash-chain ordering all depend on clock agreement. NTP failure produces confusing, correlated symptoms.
- DNS and PKI. Both are common single points that sit underneath everything above.
Break-glass is part of the HA design
Even a well-designed cluster can be fully unavailable. There must be a defined emergency path — physical console access, an out-of-band management network, or a sealed emergency credential — that does not depend on the gateway being up.
That path needs its own controls, because it bypasses the ones you built: heavy alerting on use, mandatory post-use review, and rotation after every activation. Designing the emergency path covers it properly.