How to provide failover web service and ipsec vpn?

Question

VPN

For the first time, I faced the task of providing fault tolerance for a web service running inside ipsec vpn.
Specifics are not needed, you need a general understanding of the solution or technology for further setting the task for the performers.
Simplifying the scheme, there are 2 servers in different data centers, they are synchronized with each other via an internal VPN.
The web service is published on the servers.
Each of the servers is ready to raise the ipsec tunnel with the client's server/servers.
There is an external user - a client - who wants the tunnel to be raised by default with the first server and the web service to be used on it.
In case of failure of the first server, "dynamic routing" (I don't understand what to route here, no AS, data centers are independent) should allow the client to switch to the second vpn tunnel and the second web service with a maximum downtime of no more than 15 minutes.
I can't figure out what technology is being proposed. I suggest other clients always keep 2 tunnels, and go to the web service by dns name. If the main server fails, I change the A record on the external DNS, and the client goes to the second server. TTL recording 15 minutes.
Tell me where to dig))

Answer 1

In fact, ipsec vpn is not really vpn, it's just traffic encapsulation in tunnel esp ipsec mode, which is performed after the rules-based routing in the ipsec configuration. I would advise you to raise real vpn with the client (openvpn / l2tp / etc.), including they can be raised over ipsec (if the client's security policy requires it). And then it’s easy even to resolve the main and backup VPN with metrics to the same IP (which will actually be terminated in different data centers). This is the easiest option if the client cannot balance itself between two connection points, one of which may fail.