Default Route on Mx (Auto-VPN)

[JpAlvesCroce22]

Hello everyone, how are you?
To put it in context, I'm taking over the management of a new organization and we don't have much communication with the previous administrators.

I'm checking the routing and they have deployed something that catches my attention and I think it's misapplied.

The scenario consists of a central site as a hub and 50 locations as spokes.
Full tunnel is applied through Auto-VPN, but the central site also announces the default route 0.0.0.0/0 to the spokes of the organization.

So in the routing table I have three entries 0.0.0.0/0 and two correspond to "Meraki VPN:Static Route"

The question is... if I eliminate the route 0.0.0.0/0 that is announced from the central site and leave only the "IPv4 default route" Checkbox enabled, shouldn't it be affected since they do the same thing?

[ww]

Is your hub a routed mode location with a default route to the lan side?

Or is your hub a one armed  concentrator?

[JpAlvesCroce22]

The hub is configured in router mode, effectively with a default route pointing to the LAN (Browsing Firewall)

[Ryan_Miles · Accepted solution]

This config is typically done to send spoke traffic to another egress point like another firewall. For example internet bound traffic from a spoke going over the full tunnel to the routed mode hub will enter the hub then be sent out the hub's default gateway (WAN interface).

I've seen instances in which the requirement is to not exit right back out of the hub's WAN port, but rather send to another firewall to do whatever inspection, rules, etc. And in such cases that's when the 0/0 LAN side route is needed on the hub.

But when that is the requirement I think there's a serious question that need to be asked of why use routed mode and not concentrator mode.

[JpAlvesCroce22]

Thanks for the reply @Ryan_Miles .
Perfect, then we can say that to carry the default traffic (0.0.0.0./0) to another Firewall device that is on the same LAN as our Hub, it is necessary to have the propagated route 0.0.0.0/0 via the navigation Firewall.

Would it be necessary to propagate it through the auto-vpn?

[Ryan_Miles]

Yes it would be required to be enabled within the VPN config.

[akadmin]

I have the same question as OP, but I still don't understand.

Hub has default route pointed toward LAN, and it is advertised into auto-vpn fabric - on the spoke VPN config, what does the checkbox for "IPv4 Default Route" exactly do?  I'm already default routing from the hub, as 0.0.0.0/0 is advertised into the VPN fabric.  It would appear as if this feature does nothing, in this instance.  I couldn't get an answer to this from my SE, or support.  

[Ryan_Miles]

If I'm not mistaken I think the key difference would be this. And this is specifically for a Routed mode hub as Concentrator mode only has one interface/one route out from itself.

With a Routed mode hub if you select default route on a spoke it would send all traffic to the hub. But then traffic would egress back out of the hub WAN interface unless there was a more specific route to some other destination.

Whereas if the hub has a 0/0 static route to a LAN side next hop and that's enabled in the VPN then traffic from the spoke would go to the hub then follow the next hop to the LAN side IP.

Others can check my work and chime in if I'm off base.

I've tried to capture the main points & differences in this deck

[akadmin]

I am using routed mode hubs, and the default route on each DOES point to a core switch on the LAN side.

It's been like 7 months since I tested this, but if I remember correctly, I didn't need to even check the box on the spoke for them to follow my default route to the hubs, since the hubs were already advertising a default AND it was visible in the route table.  During a maintenance window, I checked the box, and then disabled 0.0.0.0/0 on the hubs from being advertised into VPN fabric, but this broke the path, so no matter what, it appears I must announce a 0.0.0.0/0 from the hubs.  From my perspective, this feature doesn't do anything at all.

[Ryan_Miles]

If already advertising a 0/0 from the hub I would agree that checking the default route box is probably redundant.

[akadmin]

I think I understand now.  I think this feature is to be used when you're using the hub as your internet egress point, because you don't actually have a 0.0.0.0/0 route to advertise into auto-vpn in that instance.  You just have the "baked in" default route on the MX hub from it having an internet connection.  When you have a static default to the core switch, you're advertising that into auto-vpn, and therefore you don't need the box checked and it is indeed redundant.  thanks for the replies!