In firmware 6.47, an option appeared: ipsec - allow specifying two peers for a single policy for failover.
It is now possible to add another PEER to the IPSEC-Policies section.
As I understand it, you can implement IPSEC failover.
However, in practice I did not succeed. I have hAP ac lite and RB1100AHx4 in stock.
On the first, the main provider is wired, the backup is a 4G modem. On the second, both providers are wired.
Both devices are configured to switch to the backup channel when the main one is dumped.
hAP ac lite is at my fingertips, RB1100AHx4 is remote, I can access it via VPN.
Added a second PEER to the policy on RB1100AHx4, disconnected the first provider on hAP ac lite. As a result, hAP switched to the reserve kana, but IPSEC did not rise.