An approach that I have used with success is to use VPN using IPSec with GRE. This allows me to run a routing protocol like EIGRP or OSPF over the IPSec tunnel. I can manipulate the metrics to make the tunnel the higher metric path so it functions as a backup. And if the primary path fails the routing protocol will converge and will send all traffic over the tunnel. When the primary path comes back up the routing protocol recognizes a new better path and sends traffic over the primary path automatically.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...