Why sometimes the VPN comes UP on a dynamic interface instead of the dedicated interface associated with the user? Is this a bug or a normal behavior?
I am facing this with CCR1009-8G-1S-1S+ with v6.41. I have some routes that use interface to find the destination network or address and when dynamic interfaces are created these routes stay down.
Keep in mind that only-one will introduce delays in the reconnection process.
Example: When the tunnel is disconnected and the other end is reconnecting sooner than your router (which is the reason why dynamic interface is created now), MT will block the new connection attempt because of only-one setting until the active connection times out on your end.
By creating multiple static interfaces (and routes) per user and keeping only-one disabled you can accept new connections right away. Two interfaces should be enough, maybe more depending on network quality / reconnection attemps.