VPN Exclusion only working if static route to WAN interface exists

[kmoran]

Hi,

I have a hub and spoke network.  I have set up VPN Exclusion via the API however the traffic still uses the VPN unless I put a static route in place to point the destination IP to one of the WAN interfaces.  The documentation doesn't mention that static routes are needed.  Also if the WAN interface fails, the destination IP becomes unavailable until the WAN interface comes back up.  There is no way to set a secondary static route to use the secondary WAN interface.

This is what I have for the VPN Exclusion code.

dashboard.appliance.updateNetworkApplianceTrafficShapingVpnExclusions(site,\

            custom=[{'protocol': 'tcp', 'destination': '172.67.73.20/32'},\

                    {'protocol': 'tcp', 'destination': '104.26.9.109/32'},\

                    {'protocol': 'tcp', 'destination': '104.26.8.109/32'}]\

            ,majorApplications=[{'id': 'meraki:vpnExclusion/application/10'}])

We have Internal and External Hubs.  The External Hub is set as the default route.

I'd appreciate any ideas.

Thanks

[alemabrahao]

If you try to configure via the dashboard and not via the API, is the result the same?

[kmoran]

Yes, same result if configured using the GUI.

[alemabrahao]

Just to confirm, your license is Secure SD-WAN Plus correct?

[kmoran]

Yes, we have the SD-WAN+ license.  The situation is the same even if the MajorApplications is configured with an empty list.

[alemabrahao]

I suggest you open a support case.

[ww]

What is a external hub?

Is it a default route to a non meraki vpn?

[kmoran]

There is an Internal Hub that directs traffic to the data center and an External hub that directs traffic to everything else.

[ww]

So its a meraki mx hub with the [ x ] set with default route at the spoke. 

What firmware is your spoke running?