What is a single point of failure? Give me examples people often miss.
Show the answer
Say this first
A component whose failure alone takes a service down. The obvious ones are one ISP circuit, one firewall, one core switch or one uplink. The ones people miss: two circuits that share a duct or a carrier exchange, both power supplies plugged into the same PDU, a switch stack that upgrades as one unit, a single DHCP, DNS or RADIUS server, an expiring certificate, and the one engineer who knows how the edge works.
Go deeper
| Category | Examples |
|---|---|
| Physical | One fiber path, both "diverse" circuits in one conduit, one power feed, one UPS, one PDU, cooling in the closet |
| Device | Single router or firewall, single supervisor, single power supply |
| Logical | A stack or virtual pair sharing one control plane, the same software bug on both boxes, one config template pushed everywhere |
| Services | DNS, DHCP, RADIUS, NTP, the wireless controller, a license server, an SD-WAN controller |
| Providers | Two ISPs that both ride the same local loop provider |
| People and process | One admin who knows the passwords, undocumented changes, no spares and no support contract |
How to talk about it
Name the SPOF, its impact, and what you would do: remove it (add a second one with independent fate), or accept it and reduce recovery time (spare on the shelf, support contract, runbook, out-of-band access).
They will ask next
Is a switch stack a single point of failure?
Partly. If one member fails, only its ports go down and cross-stack uplinks keep the rest running. But the stack has one control plane and one software image, so a crash, a bug or a reload during an upgrade takes every member down together. For endpoint ports that is acceptable, since each endpoint has one cable anyway. For a core or gateway role I treat the stack as one failure domain.
Traps
- Listing only boxes. Power, fiber paths, shared services and people are where the real surprises are.