How to use VPN connection to main office only for listed websites?

[Masterok]

Hi,

We have Meraki MX64 that connected via VPN to Meraki MX84(main office).

How use VPN connection to main office only for listed websites not for all traffic.

Thank you.

[alemabrahao]

Can you provide more details? His question was very vague.

This VPN is SD-WAN (auto VPN) correct?

Are you talking about internal sites?

[Masterok]

1. - Yes.

2. - External websites (or IPs).

[RaphaelL]

So you want only certain website to be routed via AutoVPN and the rest ( all ? ) traffic to be routed through your local WAN ? 

1- Are those websites in your LAN ? ( RFC1918 ) If yes,  you can announce the specific routes in your AutoVPN. 

[Masterok]

So you want only certain website to be routed via AutoVPN and the rest ( all ? ) traffic to be routed through your local WAN ? - Yes

1- Are those websites in your LAN ? ( RFC1918 ) If yes, you can announce the specific routes in your AutoVPN. - How can I do that? I tried, and it allows me with whole subnets, but I can't do it with the specific websites or IPs.

Main office configuration MX84: Site-to-site VPN, type HUB

Branch office configuration MX64: Site-to-site VPN, type Spoke, HUB-main office.

Website: example.com (external)

[alemabrahao]

Are you saying that the places where MX Spokes use the main site link to access the Internet?

[Masterok]

Everyone is using his own internet, and they are connected with VPN in case you need access for example to share folder in different office.

[alemabrahao]

Maybe the solution you are looking for is VPN Full-Tunnel Exclusion, if my understanding is correct.

https://documentation.meraki.com/MX/Site-to-site_VPN/VPN_Full-Tunnel_Exclusion_(Application_and_IP%2...)

[Masterok]

It looks like a solution with the opposite result.

[alemabrahao]

So I'm sorry, I didn't understand what you want.

[ww]

If you want public ip advertised in your tunnel

In one armed concentrator hub you can advertise any ip/subnet , spokes will take that route.

In routed mode, you need a internet access connected to you lan. And set static routes to that next hop

[PhilipDAth]

You can't do this easily.