China based MX84 Internet Access Through NY Based MX100

[SteveInNP]

We have an MX100 located in NY and MX84 located in China. Currently our China based users internet requests are being router through the local China  ISP. We need for this traffic to travel through our VPN and out our NY based MX100 to the local ISP. Is there any KB articles available to assist with this or any advice which could point us in the right direction.

Thank you.

[BrandonS]

Not considering any implications with the great firewall, you should be able to simply go to SD WAN > configure > site to site VPN on your China network and choose the exit hub in NY.

[BrandonS]

exit hub is described here: https://documentation.meraki.com/Architectures_and_Best_Practices/Auto_VPN_Hub_Deployment_Recommenda...

[rhbirkelund]

Just putting it out there, the Chinese government doesn’t look to lightly at providing internet access via a VPN out of China.

So the best solution is to keep doing what you’re doing.

[Bruce]

@SteveInNP here’s the official Meraki documents regarding China AutoVPN, and note the highlighted box regarding internet access, https://documentation.meraki.com/MX/Site-to-site_VPN/China_Auto_VPN. As has already been said if you are attempting to provide internet access to people within China via a VPN that bypasses the Great Firewall you may find yourself on the wrong side of the Chinese government.

[PhilipDAth]

Also note that when you divert access from China out to another country, that some websites inside of China will stop working (China doesn't allow some web sites to be accessed from other countries).