We have an architecture where each spoke is configured not to use an Exit Hub (configured at template level) to allow us to use source based default routes per VLAN, as there are some VLANs we are required to have using local Internet Exit for all device on said vlan, where VPN Exclusions / local breakout via IP Prefix or FQDN is not possible / too dynamic to maintain the exclusion list.
I've noticed you can't do VPN Exclusions if you won't have an Exit Hub configured, you can only have some VLANS not use a source based default route. We now have a requirement to do this for a secure web gateway proxy we want to have locally exit via IP prefix.
Is there a way we can configure an MX to have both source based default route for some VLANs, but with a local exit / VPN Exclusion prefix applied over top of these? I feel like it's either one way or the other here with the config options I can see, which is only going to address one of our requirements at a time.
Diagram:
