Hi,
I have two IPsec tunnels from RouterOS v6.40.1 to two VPN endpoints in GCE. Both remote endpoints are able to route packets to the same remote subnet. Note that the local and remote SA addresses are unique for each of these two tunnels. (We’re using 2 ISPs.)
When each tunnel is run alone, with the IPsec policy for the downed tunnel disabled, things are fine. When both tunnels are active, and I toggle the IPsec policies on and off in the right order, I’m able to see packets through from my LAN through the primary tunnel to the destination. The problem is when I down the primary tunnel (simulating an outage): The IPsec policy associated w/the primary tunnel loses its phase2 “established” status and the IPsec policy for the surviving tunnel doesn’t become active. If I manually disable the primary tunnel’s policy, however, the secondary tunnel’s policy becomes active, BGP routes are exchanged, and all is good.
What I’d like to know is how to make the IPsec policies better able to handle failover situations. When the primary tunnel goes down, I want its policies disabled. And when the primary tunnel comes back up, I’d like the secondary tunnel’s policy to become disabled and the primary’s policy to become active. Alternatively, if there’s a way for each matching policy to be tried, that’d be even better. 
Thanks,
Mike