Azure vMX Routed mode & split-tunneling

[dmbooth]

Hi,

On review of the vMX Setup Guide for Azure, we were disappointed to find that you can't have a vMX in Azure in Routed Mode and do AutoVPN split tunnelling. We can understand why dashboard might need work to enable this (you'd need the table under VPN Settings to manually define local networks that you normally only see in Passthrough mode) but can't imagine we're the only ones that see this as a big miss - is it likely that this limitation will be fixed can anyone comment? Thanks.

[alemabrahao]

I don't know if this is a limitation; I believe that perhaps the purpose of vMX isn't that, but rather simply to facilitate communication with your Azure environment, so for that, Routed mode isn't necessary.

[dmbooth]

Yeah, we're familiar with vMX in Azure in Passthrough mode for AutoVPN connectivity, that's how we've always done them in the past. But a customer has seen vMX can now be in Routed mode, wants to use as a NATing gateway alongside AutoVPN. Not being able to split-tunnel is now a problem.

[PhilipDAth]

Are you using full tunnel AutoVPN mode?  Do you need to use full tunnel mode?

If you do need to use full tunnel for AutoVPN, you could look at the SD-WAN Plus licence, and look at local breakout.

https://documentation.meraki.com/Platform_Management/Product_Information/Licensing/Meraki_MX_Securit...

[dmbooth]

No we don't want to use Full Tunnel mode, but documentation says you have to use Full Tunnel mode on a vMX in Azure if you also want to use Routed mode (because the vMX won't advertise subnets). Routed mode is required because the vMX is replacing a competitor vendor equivalent which is doing NATing.

Local breakout is an option we hadn't considered, but that doesn't require SD-WAN plus I thought?

The other workaround we were considering would be to put the vMX in a separate org and configure non-Meraki VPN.