How to do DualWAN IKEv2?

RouterOS General
1

How to make failover ipsec if I have 2 WANs? Add a dedicated identity and peer for each WAN?
Current ipsec config:

/ip ipsec policy group add name="group ike2"
/ip ipsec profile add dh-group=ecp521 dpd-interval=30s enc-algorithm=aes-256 hash-algorithm=sha256 name="profile ike2"
/ip ipsec peer add address=server.net exchange-mode=ike2 name="peer ike2" profile="profile ike2"
/ip ipsec proposal add auth-algorithms="" enc-algorithms=aes-256-gcm lifetime=20m name="proposal ike2" pfs-group=ecp521
/ip ipsec identity add auth-method=digital-signature certificate="IKEv2 user@server.net" generate-policy=port-strict my-id=user-fqdn:user@server.net peer="peer ike2" policy-template-group="group ike2" remote-id=fqdn:server.net
/ip ipsec policy add dst-address=10.0.11.0/24 level=unique peer="peer ike2" proposal="proposal ike2" src-address=10.0.12.0/24 tunnel=yes
2

Normally that should be handled by MOBIKE which, AFAIK, RouterOS IKEv2 initiator does not support.

I think that RouterOS will keep retrying to re-establish the connection after one of WAN interfaces becomes unavailable (goes down or route disappears). However, I’m unaware whether it will retry indefinitely. Might be safer to have a script to toggle the peer configuration.