Default Route on Mx (Auto-VPN)

[JpAlvesCroce22]

Hello everyone, how are you?
To put it in context, I'm taking over the management of a new organization and we don't have much communication with the previous administrators.

I'm checking the routing and they have deployed something that catches my attention and I think it's misapplied.

The scenario consists of a central site as a hub and 50 locations as spokes.
Full tunnel is applied through Auto-VPN, but the central site also announces the default route 0.0.0.0/0 to the spokes of the organization.

So in the routing table I have three entries 0.0.0.0/0 and two correspond to "Meraki VPN:Static Route"

The question is... if I eliminate the route 0.0.0.0/0 that is announced from the central site and leave only the "IPv4 default route" Checkbox enabled, shouldn't it be affected since they do the same thing?

[ww]

Is your hub a routed mode location with a default route to the lan side?

Or is your hub a one armed  concentrator?

[JpAlvesCroce22]

The hub is configured in router mode, effectively with a default route pointing to the LAN (Browsing Firewall)

[Ryan_Miles · Accepted solution]

This config is typically done to send spoke traffic to another egress point like another firewall. For example internet bound traffic from a spoke going over the full tunnel to the routed mode hub will enter the hub then be sent out the hub's default gateway (WAN interface).

I've seen instances in which the requirement is to not exit right back out of the hub's WAN port, but rather send to another firewall to do whatever inspection, rules, etc. And in such cases that's when the 0/0 LAN side route is needed on the hub.

But when that is the requirement I think there's a serious question that need to be asked of why use routed mode and not concentrator mode.

[JpAlvesCroce22]

Thanks for the reply @Ryan_Miles .
Perfect, then we can say that to carry the default traffic (0.0.0.0./0) to another Firewall device that is on the same LAN as our Hub, it is necessary to have the propagated route 0.0.0.0/0 via the navigation Firewall.

Would it be necessary to propagate it through the auto-vpn?

[Ryan_Miles]

Yes it would be required to be enabled within the VPN config.