According to one aspect, a control entity (such as a policy server) in communication with a plurality of border routers in a network, generates failover entries for one or more traffic flows. Each failover entry specifies a backup path to be used by a border router when the border router determines that a wide area network interface of the border router has failed. The control entity sends the failover entries to each of the border routers. A border router operating in a network stores failover entries for one or more traffic flows. For packets received at the border router either from a local area network interface or via a tunnel from another border router, when the border router detects that the wide area network interface has failed, the border router determines how to handle the packets based on the stored failover entries.