Backup server directives

[WAU2UnknowN]

I think it would be a good idea to add the ability to specify backup connection points.
Keepalive is already present and working in the client, and the switching mechanism could be attached to it.

[ancwrd1]

I am afraid that probably won't work in the context of the currently established session, unless both primary and backup servers share the same IKE state. Does CP VPN server support such failover?
The problem is that IPSec IKE SA (security association) is stateful and depends on prior negotiations with a particular server. So we cannot switch the servers in the middle of the session unless they share the state.

[WAU2UnknowN]

State synchronization is possible when using ClusterXL (with virtual IP address), and then the switching will be transparent.
CP has another feature called Multiple Entry Point (MEP), which I was referring to.
It does not support state synchronization and is not a clustering feature, but it can be useful in environments where ClusterXL cannot be implemented or in geographically distributed environments.
On Endpoint Security, the client that receives a timeout breaks the connection and establishes a new one with the backup server from the MEP manifest, which is quite convenient if the same authentication profiles are used on the gateways.
For example, when using SAML, authentication will occur automatically based on cookies and previously obtained tokens stored in the browser.
In my opinion, this will work by specifying the backup-server-name directive and the logic for switching to the backup GW from the snx-rs side.
Thank you in advance.