How to make a failover VPN between offices based on Mikrotik RB750?

Question

VPN

Good day. Advise how best to do it: the central office and two branches in different localities. Two Internet channels are connected to the central office - the main channel is 3 Mb / s, connection via the local network of the provider via static IP, the second - 1 Mb / s PPPOE xDSL. Both providers provide white external IP addresses. The central office has a 1C server, access via VPN to which is configured on a gateway with a wider channel (FreeBSD + OpenVPN). Everything works, in principle, not bad, if the main channel did not turn off periodically. The second provider is connected to a separate gateway (also on FreeBSD). When the main channel "falls off", the address of the main gateway on all computers is manually changed, thus switching the Internet channel. In an effort to get rid of periodic Internet drops and running around the office, a Mikrotik RB750 router was purchased. The issue with channel balancing for the central office is almost resolved, but the question of raising the VPN remains open. The question is - is it possible to make a fault-tolerant VPN network for offices using another provider as a backup channel, and if possible, how to do it? That is, the VPN server will switch the user from another city to the backup channel when the main one drops, preferably without breaking the connection (but I doubt it very much here). Logically, I understand that most likely you need to use dynamic routing protocols, but I still can’t figure out how and where to fasten them. I will be very grateful for advice! The issue with channel balancing for the central office is almost resolved, but the question of raising the VPN remains open. The question is - is it possible to make a fault-tolerant VPN network for offices using another provider as a backup channel, and if possible, how to do it? That is, the VPN server will switch the user from another city to the backup channel when the main one drops, preferably without breaking the connection (but I doubt it very much here). Logically, I understand that most likely you need to use dynamic routing protocols, but I still can’t figure out how and where to fasten them. I will be very grateful for advice! The issue with channel balancing for the central office is almost resolved, but the question of raising the VPN remains open. The question is - is it possible to make a fault-tolerant VPN network for offices using another provider as a backup channel, and if possible, how to do it? That is, the VPN server will switch the user from another city to the backup channel when the main one drops, preferably without breaking the connection (but I doubt it very much here). Logically, I understand that most likely you need to use dynamic routing protocols, but I still can’t figure out how and where to fasten them. I will be very grateful for advice! how to do? That is, the VPN server will switch the user from another city to the backup channel when the main one drops, preferably without breaking the connection (but I doubt it very much here). Logically, I understand that most likely you need to use dynamic routing protocols, but I still can’t figure out how and where to fasten them. I will be very grateful for advice! how to do? That is, the VPN server will switch the user from another city to the backup channel when the main one drops, preferably without breaking the connection (but I doubt it very much here). Logically, I understand that most likely you need to use dynamic routing protocols, but I still can’t figure out how and where to fasten them. I will be very grateful for advice!

Answer 1

Here is the manual for the topic.

Answer 2

raise 2 branch 2 tunnels, configure OSPF + BFD, when one channel drops, everything will automatically switch to another.
OSPF+BFD to configure from both parties (tso and branch).