How to setup BGP failover through IPsec?

Hi all,

We have several Branch sites connecting to a Datacenter through MPLS using BGP routing.

I've been trying to setup a failover using IPsec VPN in case MPLS connection fails.

In that case I used weight 100 for MPLS and weight 50 for IPsec.

Failover was working but failback caused lots of issues.

I have routemaps in place denying external IP addresses.

Anyone having thoughts how to set this up correctly?

Attached a diagram of a Site to Datacenter connection.

Kind regards,

Alexander