Best Of

Wait for a few days.

Doing the POC on my lab.

Will the USG continue to check the active WAN1 line after connectivity check on WAN1 failed and USG switched-over to passive WAN2 line? Means, does the USG automatically switch back to WAN1 as soon as it is available again?

They have L2TP/IPSEC working for remote devices so all they need is the site to site.

Here is a run through

VPN gateway

IKEv2

interface WAN1

peer gateway

You need to know which end or both to be nailed up Static Address (can use domain name) to connect to the other end or Dynamic Address for the other end to connect to this end to be Site-to-site with Dynamic Peer

uncheck Enable Two-factor Authentication

VPN connection

Nailed-Up on one of the ends

Site-to-site with Dynamic Peer or Site-to-site depending how you setup VPN gateway

set your local/remote policy

routing rules add if needed