More than one HQ in SDWAN BBC

Hi everyone,

In BBC SDWAN, is it possible when we need to add more than one HQ device in the SDWAN VPN topology?
assume we have DC and HQ sites, which all branches need to reach.

Yes this is possible.

Hi Arsalan,

Thank you Arsalan
Is there any configuration reference regarding this?

Usually in order to implement a multi-HQ setup in an SD-WAN environment, you need to consider the following:

- you need to configure each branch to connect to multiple HQ sites.
- configure dynamic routing protocols to select the optimal path for traffic based on real-time conditions.
- ensure that there redundancy and failover is in place to avoid any disruptions or downtimes in the network.

Yes, in a Software-Defined Wide Area Network (SD-WAN) setup, it is indeed possible to have multiple headquarters (HQ) devices within the VPN topology. By employing SD-WAN technology, you can establish a flexible and scalable network architecture that accommodates several HQ locations alongside data centers and various branches. This allows for enhanced redundancy, load balancing, and optimized routing, enabling branches to efficiently access multiple HQ sites and data centers while maintaining reliability and performance across the network.

yes, you have to set up a second ngaf device on hq with the same local vpn users in ha mode. ensure all your branch are able to connect to two hq devices.

Yes it is possible Di the same on backup

Yes, Sangfor BBC SDWAN allows you to add more than one HQ device in the SDWAN VPN topology. This can be useful for a variety of reasons, such as:

    Load balancing: Distributing traffic across multiple HQ devices can improve performance and availability for your branches.
    Redundancy: If one HQ device goes down, the others can take over and keep your branches connected.
    Geographic diversity: You can place HQ devices in different locations to improve latency and resiliency for branches in those regions.

There are two main ways to add more than one HQ device to your Sangfor BBC SDWAN topology:

    Full mesh: In this configuration, each branch device has a VPN tunnel to every HQ device. This provides the best possible redundancy and load balancing, but it can also be the most complex and expensive to set up.
    Hub-and-spoke: In this configuration, all branch devices tunnel to a central hub device, which then tunnels to each of the HQ devices. This is a simpler and more cost-effective way to add redundancy, but it can create a single point of failure if the hub device goes down.

The best way to configure your Sangfor BBC SDWAN topology will depend on your specific needs and requirements. If you're not sure which option is right for you, I recommend talking to a Sangfor sales engineer.

Here are some additional things to keep in mind when adding more than one HQ device to your Sangfor BBC SDWAN topology:

    You will need to have enough VPN licenses to cover all of your devices.
    You will need to configure the routing and security policies for your HQ devices.
    You may need to upgrade your hardware or software to support the additional devices.

Re posting My answer because attachments are not visible

Just like you make 1st HQ, do the same configuration on backup HQ,
I am also sharing the configurations steps , also pictures attached

Note: Do these steps on both HQ
1 Select the WAN interface
2 In Basic setting select Wan Lines and VPN subnets
3 In Local Users , Add VPN users , also the second HQ
4 VPN connection Add the user name second HQ  
Primary IP and SecondaryIP is your Primary and Secondary IP (do not insert 2nd HQ IP)

Also sharing the PDF

yes it is quite possible.