Customer deploy a site with two WAN links ( WAN-0 & WAN-1)  in Active and backup mode .

This results in less utilization of backup WAN link ( i,e WAN-1) and most of the traffic carried over primary link i,e WAN-0.

The site also had DVPN tunnels formed over WAN-1 link with other sites. When customer tries  to make it active-active setup by editing WAN-1 link , job got failed resulting WAN-1 in partially deployed state. 

The KB article explains how to resolve this problem . 

1. Site-A provisioned with 2 WAN links (WAN-0 and WAN-1) where WAN-1 is selected as backup.
2. Site-A has DVPN tunnels with other Site-B 
3. DVPN tunnel between Site-A and Site-B was deleted. 
4. User tries to edit the WAN-1 link of Site-A by disabling backup check box in CSO UI portal. 
5. Edit of WAN_1 link on Site A failed with below mentioned error where IKE gateway still pointing to previously deleted DVPN tunnel with Site-B 

Error seen in CSO Job Logs / device messages: 

[edit security ike gateway df85f6615e1340c742de161a81dfd5cd external-interface] </nc:error-path> <nc:error-info> <nc:bad-element> external-interface reth1.0 </nc:bad-element> </nc:error-info> <nc:error-message> Referenced interface must be configured under [edit interfaces] hierarchy </nc:error-message> </nc:rpc-error> <nc:rpc-error> <nc:error-type>protocol</nc:error-type> <nc:error-tag>operation-failed</nc:error-tag> <nc:error-severity>error</nc:error-severity> <nc:error-message> commit failed: (statements constraint check failed) </nc:error-message> </nc:rpc-error> </commit-results> </nc:rpc-reply> ]]>]]>

When editing the WAN links CSO will try to delete the dvpn tunnels connected to this device .

Below mentioned steps can be followed to resolve issues with respect to DVPN tunnel configuration when edit WAN link failed on the site.

1. Check the status of DVPN tunnels in both sites ( Site -A and Site -B) 

2. Check the DVPN tunnel configuration group in the running configuration on both devices (Site-A and Site-B) . 

3. If there is a mismatch in DVPN tunnel configuration where Site-A doesn't have configuration but Site-B still has the DVPN tunnel configuration group then manually try to delete the dvpn tunnel configuration group on the device and the re-sync device configuration via CSO.

Example : 

root@Site-B # delete groups TenantAB_SITE-A_WAN_1_SITE-B_WAN_1_IPSEC_0

root@Site-B # delete apply-groups TenantAB_SITE-A_WAN_1_SITE-B_WAN_1_IPSEC_0

root@Site-B #  commit check 

root@Site-B #  commit and-quit 

5. Try editing the WAN links as per the requirement i.e WAN_1 link change it from back-up to active role.

6. Once the job is successful, the WAN_1 should be in "DEPLOYED" and "ACTIVE" state.