I have a site-to-site IPsec VPN with two TP-Link ER7206 v2.20 routers running firmware 2.3.2 (one at the main office and one at a branch office), both configured on WAN2

Both routers have two internet connections (WAN2 and WAN3). I'm using DDNS in case the public IPs change.
The VPN connection initiator is configured at the branch office.

I'd like the connection to automatically switch to WAN3 when the internet provider's service on WAN2 (at the branch office or main office) goes down, to maintain the VPN connection between the main office and the branch offices.

When WAN1 is working, I'd like users to use WAN2 to browse the internet and avoid overloading WAN1. Is this possible?

How does failover work?

Thank you very much!

ferscha