Configured VPN using BGP to cloud provider at site A and everything worked as expected, then configure VPN using BGP to cloud provider at site B and traffic from site A to site B broke.

Looking at logs, saw traffic from site A reaching site B then getting routed by BGP through the cloud provider back to site A because BGP is advertising that route as the shortest path.

for logs, look at your BGP summary and the BGP routing table to see where subnets are being routed to

site A subnets are on the left and the VPN subnets are on the right in example below;

get router info routing-table
allpath=router, objname=info, tablename=(null), size=0Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

B 10.11.7.1/24 [20/100] via 128.112.2.214, vpn-cloudprovider-1, 00:01:11
B 10.11.8.0/26 [20/100] via 128.112.2.214, vpn-cloudprovider-1, 00:01:11
B 10.12.1.0/28 [20/100] via 128.112.2.214, vpn-cloudprovider-1, 00:01:11

Solution:

Create a BGP community, then define a no export rule to prevent routes being advertised to cloud provider do not get propagated to external networks. Assign the new rule to the BGP neighbors and perform this task on both site A and B, this will solve the routing issue and all your traffic will flow as designed.

Here is an example of what i did on site A;

  1. Create community
    config router community-list
    edit "no-export"
    config rule
    edit 1
    set action permit
    set match "no-export"
    next
    end
    next
    end

  2. Create route-map that matches the community
    config router route-map
    edit "outbound to cloudprovider"
    config rule
    edit 1
    set match-community "no-export"
    next
    end
    next
    end

  3. Apply route-map to BGP cloudprovider neighbor
    config router bgp
    config neighbor
    edit "128.112.2.214"
    set route-map-out "outbound to cloudprovider"
    next
    end

  4. Clear bgp router to take new configs
    exec router clear bgp all