Dual hub BGP on loopback question

[AugustWest]

Howdy!

We're beginning a merger at my org and I need to re-IP my dual hub BGP on loopback schema. My first and biggest question would be, is it even possible to change the BGP and HC loopback as well as the IPsec tunnel IP's, add the new networks to BGP on one hub; say the secondary, update the spokes with the new config, and then once that is successful, repeat the process for the primary hub with little to no downtime?

I've been attempting to do this in a partial lab environment and I'm having issues with the spoke not loading the changed tunnel into the sdwan rule as a selected route even though from the hub, the new loop back and IPSec interface IPs are pingable to and from the spoke and hub. What I do find interesting is that if I keep the changes in place on the spoke but revert the actual tunnel interface IP back to the original address, it gets loaded into the sdwan rule even though the secondary hub head end tunnel is still the changed address which would be a completely different subnet. If anyone would like for me add some config, please let me know. I appreciate any assistance!

[Jean-Philippe_P]

Hello AugustWest, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[AugustWest]

Thank you. 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[AugustWest]

I appreciate it! I have the SDWAN rule/health check issue sorted out. The source addresses for the health check members were not changed to the new addresses when I ran the template. I've updated that in the template and deployed it to a couple spokes with the updated config for the secondary hub and everything is working. I'll be testing changing the primary hub tonight. If that goes well, I'll update this thread. 

[Jean-Philippe_P]

Hello again AugustWest,

I found this solution. Can you tell us if it helps?

To address your query about re-IPing your dual-hub BGP on the loopback schema with minimal downtime, follow these steps:

1. Plan the IP Changes:

   • Determine the new IP addresses for the BGP loopback interfaces and IPsec tunnel interfaces.
   • Ensure that the new IP addresses do not conflict with existing network addresses.
     
     

2. Update the Secondary Hub:

   • Change the BGP loopback and IPsec tunnel IPs on the secondary hub.
   • Add the new networks to the BGP configuration on the secondary hub.
   • Ensure that the BGP configuration reflects the new IPs and routes.
     
     

3. Update the Spokes:

   • Update the spokes with the new IPsec tunnel configurations pointing to the secondary hub.
   • Ensure that the BGP configuration on the spokes is updated to reflect the new loopback IPs.
   • Verify connectivity between the spokes and the secondary hub.
     
     

4. Test the Configuration:

   • Ensure that the new configuration is working correctly by testing connectivity and route propagation.
   • Check that the new tunnel interfaces are correctly added to the SD-WAN rules.
     
     

5. Update the Primary Hub:

   • Once the secondary hub and spokes are confirmed to be working, repeat the process for the primary hub.
   • Update the BGP loopback and IPsec tunnel IPs on the primary hub.
   • Update the spokes to reflect the changes for the primary hub.
     
     

6. Final Testing:

   • Verify that both hubs and all spokes are functioning correctly with the new IP configuration.
   • Ensure that the SD-WAN rules are correctly applied and that traffic is routing as expected.
     
     

Regarding the issue with the SD-WAN rule not loading the changed tunnel, ensure that:

• The SD-WAN configuration is updated to include the new tunnel interfaces.
• The SD-WAN health checks are configured correctly for the new IPs.
• The routing table reflects the new IPs and routes.

If the issue persists, consider reviewing the SD-WAN configuration and ensuring that all relevant settings are updated to reflect the new IP addresses.