Redundancy patterns: active-active and active-passive
In short: Redundancy removes single points of failure by adding spare capacity. In active-active designs every node serves traffic; in active-passive a standby takes over when the primary fails. N+1, 2N and hot, warm or cold standbys describe how much spare you have and how ready it is.
Find the single points of failure
A single point of failure (SPOF) is any part whose loss stops the whole service. Start every availability design by tracing a request end to end: DNS, internet links, firewalls, load balancers, servers, databases, storage, power and cooling, and even the one engineer who knows how it works. Each SPOF is a candidate for redundancy.
Active-active and active-passive
In active-active, two or more nodes handle live traffic at once, usually behind a load balancer. If one fails, the others carry on. The risk is capacity: if two nodes each run at 70%, losing one leaves the survivor at 140% and it collapses. Size so the remaining nodes can carry the full load.
In active-passive, one node serves while a standby waits. On failure, the standby is promoted, often by moving a virtual IP address. This is common for firewalls, databases and stateful appliances because only one node writes data. Network gateways use the same idea with first hop redundancy protocols such as HSRP and VRRP.
| Factor | Active-active | Active-passive |
|---|---|---|
| Hardware use | All capacity in use | Standby idle most of the time |
| Failover time | Near instant for stateless work | Seconds to minutes |
| State handling | Must share or replicate state | State copied to standby |
| Complexity | Higher, risk of conflicts | Lower, but failover must be tested |
| Typical use | Web and app tiers | Databases, firewalls, legacy apps |
How much spare?
N is the number of units you need for full load. N+1 adds one spare, so any single unit can fail. 2N duplicates everything, often as two fully separate paths, such as A and B power feeds in a data centre. 2N survives the loss of a whole path, but costs twice as much.
Standbys differ in readiness:
- Hot: running and synchronised, takes over in seconds.
- Warm: running but needs data catch-up or configuration, minutes to hours.
- Cold: hardware or images available but not running, hours to days.
Common mistakes
- Hidden shared dependencies: two servers in the same rack, on the same switch, or using the same DNS server.
- Untested failover: the standby has an expired licence or old configuration. Test regularly (see resilience testing).
- Correlated software failure: a bad patch rolled to every node at once. Stagger changes.
- Forgetting state: sessions stored on one web server are lost when it fails. Store them in a shared cache or database.
Tip: in design exams, show the redundancy on your diagram (two links, two switches, two firewalls) and state the failover method for each pair.
Practice
Two active-active web servers each run at 65% CPU. What happens if one fails?
Your site needs 4 UPS units for full load. How many for N+1?
Why are databases often active-passive?
Key takeaways
- Start by finding every single point of failure.
- Active-active uses all nodes; size so survivors carry full load.
- Active-passive keeps a standby; simpler for stateful systems.
- N+1 adds one spare; 2N duplicates the whole path.
- Untested failover and shared dependencies defeat redundancy.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.