# VPN #2 four-tunnel active-active BGP acceptance — 6 August 2026

## Accepted state

- AWS stack `eg334s-team2-vpn2-bgp`: `UPDATE_COMPLETE`.
- Ireland VGW `vgw-02efe604037a218cf`, ASN `64512`.
- Azure gateway `eg334s-team2-vpngw`: active-active, BGP enabled, ASN `65515`.
- Azure gateway public IPs: `20.24.123.36` and `20.239.27.76`.
- AWS VPN connections: `vpn-00212b345b8d39fc5` and
  `vpn-0f16c316663f4edb0`.
- Four AWS tunnel endpoints: `52.17.86.15`, `52.209.42.195`,
  `34.252.227.88` and `52.17.28.31`.
- All four tunnel telemetry records reported `UP`; each reported two accepted
  routes.
- Four Azure BGP peers reported `Connected` and two received routes each:
  `169.254.21.1`, `169.254.22.1`, `169.254.21.5` and `169.254.22.5`.
- Azure learned `10.1.0.0/16` over all four eBGP peers. The Ireland route table
  learned `10.2.0.0/16` through VGW propagation.

## Data-plane isolation test

The two retained static VPN #2 tunnels were deliberately made unavailable for
the acceptance window. With only the new BGP topology available, Azure Network
Watcher tested both Ireland application nodes:

| Destination | Protocol | Result | Probes | Failed | Average RTT |
|---|---|---:|---:|---:|---:|
| `10.1.1.119` | ICMP | Reachable | 10 | 0 | 220 ms |
| `10.1.1.119:80` | TCP | Reachable | 66 | 0 | 221 ms |
| `10.1.2.191` | ICMP | Reachable | 10 | 0 | 221 ms |
| `10.1.2.191:80` | TCP | Reachable | 66 | 0 | 221 ms |

The original static keys were restored immediately after the test. Final
telemetry showed the four BGP tunnels up and the two static rollback tunnels up.

## Evidence boundary

No pre-shared key, credential or private key is recorded here. The test proves
that the BGP topology carried private ICMP and HTTP traffic independently of the
legacy static path. It does not claim zero-loss convergence for a future tunnel
or gateway outage; that requires a separately timed failure drill.