IPsec VPN won't show as down on one side for failover

[tgold]

I am testing a vpn failover situation and basically followed this guide: https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-ipsecvpn-52/Redundant_VPN_Config...

I have a 200E at our datacenter and a 60E that will be at a retail location. Both have 2 wan connections. I set the backup route to have a higher distance so it will come into play when the primary tunnel goes down. I only configured 2 tunnels instead of 4. wan1 to wan1 and wan2 to wan2.

The issue I am having is if I unplug the primary wan interface on the 60E, the primary tunnel goes down and the backup route shows up in the routing monitor and traffic starts flowing over the backup tunnel pretty quickly. If I try to simulate a "soft" internet failure on the 60E where the wan1 interface is still connected but I change the vlan on the switch it's on so it can no longer hit the internet, the tunnel on the 200E shows down right away, but the tunnel on the 60E will still show as up for as long as I can tell. I watched it in this state for an hour at least. I was trying to send traffic from both sides the whole time. If I go in and change something with the ipsec config it will refresh and finally realize the tunnel is down and the backup route will come up.

I have dead peer detection set to on demand on both sides as well as auto keep alive on. I know I could enable a link monitor on wan1 to google dns for example that would shut down the interface and force it bring down the tunnel, but that is not mentioned in the guide and really I'm just curious at this point why this is happening.

Any ideas?