Hub trying to connect to LTE private ip`s

[Gillic01]

I have noticed my mx450`s are trying to create tunnels to LTE devices on Wan2 Private ip address, but we are denying   this  on our ASA. But don`t think this is a good idea to permit our MXHub to talk out to private ip`s

[Ryan_Miles]

MXs register their interface IP (private) and NAT public IP with the VPN Registry. This allows for MXs to form a tunnel over a private WAN and if that's not available over the internet. I assume you're just seeing this process via firewall logs or packet captures.

[Gillic01]

Yes so we deny this Hub to talk out to those private ip addresses, if I did add an acl to allow it, how would it even know where that private ip is? 

[PhilipDAth]

Being private IP addresses - wouldn't they be assigned from your team to the Telco to use?

If you know what block they are in then you could create a rule to allow that block.

The other thing is the MX450 is a firewall.  Is there any reason to block any traffic to or from this firewall?

[Gillic01]

I think you are correct. Problem with that is CradlePoints with private ip on their inside, the MX Headend would never be able to connect to that outside of the tunnel which is what is happening, even if I allowed that traffic he wouldn`t know where to go. Checking with Support now, should be able to block this traffic maybe on the headend