Best practice to block vpn site to site traffic

[RMP-Topher]

Senario:   Hub and Spoke:  Block VPN traffic from one remote mx to another remote mx that use the same hub. 

current test

but I can still ping the /32 address 

Appreciate suggestions

[RMP-Topher]

Update:  10minutes later the rule starts working.  I can see 2 minutes for config changes but 10?  That seems like a lot.

[ww · Accepted solution]

It does not apply to active sessions. You need to stop ping for like 5 minutes