Controlling subnets and non-merkai VPNs.

[rsage_voda]

I have an organization with some 20 sites. All sites partake in the auto-auto site to site vpn for their Corporate subnets. I also have two non-Meraki VPNs one to Azure and one to a specialist 3rd Party from a single site. The Corporate subnets need to access Azure.

I have a standalone subnet that needs is used to communicate with the specialist 3rd Party VPN. 

Sporadically the 3rd Party is reporting that they are seeing traffic coming from one of the Corporate subnets. Of which there are 5 enabled for VPN. 

Raised case with Meraki and there advice was to disable the VPN which isn't an option

Are VPN Outbound FW rules the only way to control what traffic goes down what VPN?

[alemabrahao · Accepted solution]

VPN has some limitations, but other options would be you can tag VPN subnets and selectively enable them for VPN participation.
On the non-Meraki VPN peer configuration, you can define which local subnets are advertised and which remote subnets are reachable.

[PhilipDAth]

You can tag a network to be included in a VPN, but you can't tag individual subnets.

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#IPsec_VPN_Peers