you must config
in R1 under IPSec map
set peer R2
set peer R3
in R2 and R3 you must config
set route <-reverse-route
this make R1 know the LAN behind R2 and R3 only when the IPSec tunnel is establish, and hence the R1 have two peer it will try R2 then if not response it will try R3.
@isbou1986 use FlexVPN. Several options, use a dynamic routing protocol and establish an adjacency to both routers, then set a priority to prefer one tunnel over the other. The other option is to use the FlexVPN client configuration, this specifies a primary VPN, if that fails it will utilise the next router and establish a tunnel. Example here.
The first option using a routing protocol is the fastest at failing over, as the VPN is already established.
@isbou1986 what configuration do you already have?
Here is the example of the FlexVPN client I was referring to, where the list called "Flex_Client" defines the active and standby peer IP addresses used for failover.
crypto ikev2 keyring Flex_key
address 0.0.0.0 0.0.0.0
pre-shared-key local cisco
pre-shared-key remote cisco
crypto ikev2 profile Flex_IKEv2
match identity remote address 0.0.0.0
authentication remote pre-share
authentication local pre-share
keyring local Flex_key
crypto ikev2 dpd 30 5 on-demand
crypto ikev2 client flexvpn Flex_Client
peer 1 18.104.22.168
peer 2 22.214.171.124
client connect Tunnel1
crypto ipsec transform-set IKEv2 esp-gcm
crypto ipsec profile default
set ikev2-profile Flex_IKEv2
description FlexVPN tunnel
ip address negotiated
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source Ethernet0/0
tunnel destination dynamic
tunnel protection ipsec profile default