Graceful or Immediate WAN failover for non-Meraki site-to-site VPNs?

[JohnMas]

Does anyone know which setting for WAN failover works best when dealing with a non-Meraki VPN? Graceful or immediate?

I can't find documentation on what the appliance will do with the VPN tunnel, whether it waits during graceful mode to restart tunnel negotiation using the secondary link as it would an existing flow.

In the past, I've had issues where a fail-back from the secondary WAN to the primary that's too quick (<1-2 min) will result in stale security associations on the third-party appliance and a failure to rebuild the tunnel to my primary WAN.

I'm curious if the feature makes any difference in this scenario.

[alemabrahao]

For non-Meraki VPNs, there isn't much to do, the failover has to be manual since you can't do a PBF on the MX.