Configure Redundant ASA5506 VPN

My Cisco ASA 5506 already runs a stable site-to-site VPN; I now want a second tunnel at the same location so I can keep working even if the main link drops. The backup circuit will be on a separate cable or fiber line, and the sole purpose of the new tunnel is business continuity.

You will have full CLI and ASDM access plus the current running-config. I need you to build and test a fail-over solution that flips traffic to the secondary link automatically, then restores normal routing once the primary is back up. I’m open to whichever native ASA protocol stack you feel is best—IPSec, IKEv2, or another reliable option—as long as it integrates cleanly with the existing setup.

Deliverables
• Updated ASA configuration with secondary outside interface, tunnel, NAT and ACL entries
• Route-tracking or SLA monitor code that triggers seamless switchover and fallback
• Validation report showing packets flowing over the backup link during a forced outage
• A concise change log and rollback plan

Config must be clean, documented and ready for immediate deployment. Please include your timeline and any prerequisites so we can get started right away.