IPSEC S2S VPN Migration

[Simon_Macpherso]

Hi all,

We need to migrate multiple existing IPSEC S2S VPNS with a remote 3rd party that is replacing their remote gateway and changing peer IP. The VPN domain is not changing.

On our side, there is 4 HA clusters each with its own community to the remote peer.

To test one site, a new interoperable gateway object has been created for the new peer IP as well as a new community – the remote peer is implementing stricter encryption controls.  

The existing interoperable gateway object will be taken out of the existing community and the new object will be added to the new community. The VPN domain will still be associated to the existing interoperable gateway object.

We can’t remove the VPN domain association from the original object as the object is a member of other VPN communities.

Is it possible to have the same VPN domain added to 2 interoperable device objects simultaneously without causing issues with regards to tunnel establishment? As mentioned, the interoperable device objects are not both members of any one community.

Regards,

Simon

[Juan_]

Yes, as long as you don't have two communities for the same local gateway with the same remote encryption domain it will be fine.

[Simon_Macpherso]

Thanks @Juan_ Yes it works as expected. 

e.g.

GW A -  VPN domain 10.10.10.0/24

GW B and GW C - VPN domain 20.20.20.0/24

Community 1 - GW A and GW B

Community 2 - GW A and GW C

GW A receives a packet from 10.10.10.0/24 going to 20.20.20.0/24 GW A determines traffic should go to GW B using Community 1 settings, or GW C using Community 2 settings.

[the_rock]

I agree with @Juan_ , what he said makes sense. Worst case scenario, make sure to verify policy, as it would tell you if there is a conflict and you can always revert if need be.