VMX for CGNAT traversal

[LontzroV]

Good day everyone. Our company is comprised of 4 sites, with the main site hosting most of the webfacing resources. The problem we have is that there is only one ISP who offers wired internet (rural setting); that being our primary uplink. Our backup internet currently consits of an MR modem uplinking to the cellular network, although we are also considering Starlink. However, both of those solutions are are problematic for us due to their implementation of CGNAT. Looking for a way around this issue I came across vMX.

I picture incorporating the vMX in our VPN infrastucture as a hub and then have the hostname of our main site resolve to the vMX public IP. From there I would add the main-site MX as a spoke to the vMX hub.

Is the above outlined setup realistic? How could traffic be addressed to local servers on our main site if their subnet is not configured on the vMX? Can vMX be used for this purpose or am I way off? Any feedback or input appreciated!

[MilesMeraki · Accepted solution]

So.. What you're trying to say is that you're looking at relocating your public web infrastructure to a public cloud and implementing a vMX in the design to act as the firewall and VPN hub to other MX's for that env?

This shouldn't be an issue. Personally, I wouldn't route your DNS records for your web infra at the vMX i'd look at implementing a WAF service in front of your web servers and then pointing the DNS at a Load balancing service.

[PhilipDAth]

I have done something similar with a group of sawmills (all rural).

They did have their main server at their HQ.  I relocated all of its functionality to Amazon AWS.  I deployed an MX to each site and a VMX into Amazon.  The sites used to have dual rural Internet providers.  Now we have one rural Internet provider and Starnet at each site.  Starnet works great, and we have now made the rural Internet provider links backup only (so they sit there doing nothing unless Starlink fails).

Works great.

[LontzroV]

Thanks for sharing your experience, that might be something for us to consider for the long run.