In order to conform to the basic principle of unambiguous IPsec rules, backup situations require VPN rules for the primary connection to be deleted first, and then new rules for the backup connection are created.
If the backup connection fails, the backup module selects the next backup connection if several have been configured.
