Hello,
I tried to setup site-to-site IKEv2 tunnels between routers using multiple ISPs but failed. When the main peer falls down due to DPD timeout active policy does not move to another one in a row.
Is there any way to break this logic?
I don’t think it can be done this way. But you can make multiple tunnels using different ISP or technology (IPv4/IPv6) and then use a routing protocol like OSPF or BGP to select the working tunnel(s).
Yes, sure, but I hoped to setup it in tunnel mode, not transport.
Maybe it’s a feature request for IPSec improvement, change active policy selection logic.