You can only do it using IKEv1.  Cisco removed the functionality for IKEv2.   All you do on the "set peer" line is add a second IP address - your WAN2 IP address. https://community.cisco.com/t5/vpn/backup-peer-ip-configuration-on-site-to-site-vpn-between-asa/td-p/2303494    Thinking about it more, you could use IKEv2, but put the ASA into responder mode only (so it won't attempt to build the VPN), and authenticate based on an identify presented by IKEv2 on the MX.   Search for "remote id" in this article: https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings  ... View more