During a period of recognized primary network access failure, regardless of whether the backup connection is active, the VPN Gateway continues to test the primary network connection to determine if WAN connectivity has been restored.

When the WAN connectivity is found to be active again, the VPN Gateway continues to monitor the status for continuous connectivity for a specified amount of time. This is done to ensure continued stability of the primary network connectivity and make sure it is not just a temporary recovery. The amount of time is specified in the AT&T Administration Server Device Profile Broadband Recovery Time option, which defaults to 5 minutes.

Once the primary connectivity is found to be continuously active for the specified amount of time, any future VPN authentication requests are issued over the primary connection. If the backup connection is active when the primary connectivity recovers, the VPN Gateway waits for a period of inactivity to perform the transition back to the primary line. Currently the backup connection must be inactive for the amount of time specified by the Auto-Switch Time option in the AT&T Administration Server Device Profile (default is 10 seconds) in order for the VPN Gateway to disconnect the backup connection and transition to the broadband connection. The Customer Account Administrator can specify the inactivity wait time as part of the VPN Gateway Device Profile stored in the AT&T Administration Server.

The transition from the backup connection back to the primary connection is dependent entirely on network usage and broadband stability. The exact time of the transition cannot be specified; however the user has the ability to manually transition the tunnel back to the primary connection by manually disconnecting the cellular connection.