A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes. - All traffic must be routed through the primary tunnel when both…

Enabling Dead Peer Detection (DPD) on the IPsec VPN tunnel allows FortiGate to proactively monitor the liveness of the peer. If the peer becomes unresponsive, DPD quickly detects the dead tunnel and brings down the interface, triggering a route change to the secondary tunnel much faster than relying solely on routing protocol timeouts.

Configuring a lower administrative distance on the static route for the primary tunnel ensures that it is preferred by FortiGate's routing table when both tunnels are operational. When the primary tunnel goes down (detected by DPD), its route is removed, and the static route for the secondary tunnel with its higher administrative distance becomes the active route, enabling failover.

Auto-negotiate and Autokey Keep Alive are related to maintaining phase 2 SAs and are generally good practices but do not directly provide the fast dead tunnel detection and route prioritization required for this specific failover scenario.

Configuring a higher distance on the primary tunnel and lower on the secondary would cause the secondary tunnel to be preferred, which contradicts the requirement that all traffic must be routed through the primary tunnel when both tunnels are up.