vMX and vWAN in Azure

[Elliot_Sandell]

Hello have a couple of questions around vMX in Azure as its been a while!

• Meraki vMX and Client VPN in conjunction with vWAN (so routes learned via eBGP) is client transport to a S2S VPN terminated on the VPN gateway supported?
  • I.e. Client VPN terminates on the vMX and routes towards a S2S VPN that terminates in vWAN as well?

• vMX in Routed Mode vs Concentrator Mode - reading the documents suggests in Routed Mode advertisement of routes in NAT node the the AutoVPN isn't supported in Split Tunnel branch deployments? 
  
  vMX Setup Guide for Microsoft Azure - Cisco Meraki Documentation
  
  

[PhilipDAth]

I am having trouble understanding the question.  Could you expand it a bit more?

[Elliot_Sandell]

Teach me for writing question last thing on a Friday...

In the context of the current vMX capabilities in Azure, I’m considering using a vMX appliance and have a requirement for Client VPN (Secure Client).  Have the option of terminating some site-to-site vpns (third party IPSEC) onto the vMX or on something else (vWAN / Azure VPN Gateway).

First Question:  Client VPN and S2S routing with vMX in Azure

My understanding is that if both Client VPN and S2S VPNs are terminated on the same vMX, then routing Client VPN traffic towards the S2S tunnels would require eBGP on the external peer, which can make S2S termination on the vMX more complex.

• In a vWAN + Route Server integration scenario, where eBGP is enabled and S2S VPNs are terminated in vWAN, is it correct to assume that Client VPN routing would function as expected?

Second Question: vMX passthrough vs NAT mode with split tunnelling

For a vMX deployed in Azure as part of an SD‑WAN design that requires split‑tunnel spoke routing only, the documentation suggests that passthrough / concentrator mode is supported, but NAT mode is not, as NAT mode would require spokes to default‑route traffic via the vMX.

• Is this still the case when BGP is enabled within AutoVPN and/or external participant routing?

Same overall scenario where there is a need for some client VPN connectivity on the vMX and passthrough will obviously mean no security services and split tunnelling only, so just trying to understand of there are any differences in the documentation vs actual experiences for anyone else.