I’ve just completed the migration following this process
1) Don't remove the VRRP con figuration so all MD will still be pointing to the VRRP ip and you will be able to configure them
2) Shutdown the backup MM VM
3) Apply L3-Configuration
Example: DC1 MM Config
#DC1 MM: L3 Redundancy Configuration
no paging
configure terminal
cd mynode
master-l3redundancy
l3-sync-state primary
l3-sync-time 2
l3-peer-ip-address 10.30.156.33 ipsec aruba123
!
write memory
DC2 MM Config
#DC2 MM: L3 Redundancy Configuration
no paging
configure terminal
cd mynode
master-l3redundancy
l3-sync-state secondary
l3-sync-time 2
l3-peer-ip-address 10.30.40.123 ipsec aruba123
!
write memory
4) Push L3. redundancy Config to all MD from my MM master
(MM01) ^[mynode] (config) #secondary masterip 10.30.40.123 ipsec aruba123
5) Remove the VRRP configuration from MM master
6) Power-off MM master VM
After 15 minutes all my MD were pointing to the backup MM except the MD connected through my VPNC cluster so basically the command pushed on the step # 4 also included my VPN branches controller so all of them took the secondary MM IP as secondary master controller instead of a secondary VPNC cluster so none of them where able to create an IPSec tunnel.
After awhile, I've recovered all of them powering up my MM Master again
I've removed this configuration for the VPN Branch to test it again.
Thanks,
Antonio