I have an MX in vpn concentrator mode at our hub and an MX, MS (switch) and MR (AP) at a spoke site. The spoke has dual links, one via the internet and one via the internal network. The spoke MX is up and working via autovpn into the hub MX over both links, and the MS and MR on the LAN of the spoke have Meraki cloud connectivity via the central MX internet connectivity path.
I've bought up a new ssid at the spoke and am trying to test connectivity to the MX in the datacentre (via the Test connectivity button under addressing and traffic on the MR) and I can see in our firewall logs that the MR is trying to establish an auto-vpn tunnel to the external NAT IP of the hub MX, which of course is failing as you would need to go externally and come back in via the hub internet to match that NAT entry. I know that the MRs are probably built to be used independently of MR/MX infrastructure, but I thought that the MR would have tried to build the autovpn tunnel via the internal internal as well ie internal IP of the MR and internal IP of the hub MX.
Is there anyway to configure the AP to build the autovpn from the MR to the MX at the hub via the internal network. I've tried both Layer 3 roaming with a concentrator and VPN: tunnel data to a concentrator as options on the ssid but I have the same issue with both. I know that I could probably put the MR on an internet facing vlan at the spoke and then it would build the auto-vpn tunnel over the internet back into the hub MX and work because it would match the NAT, but then I lose redundancy should the internet link at the spoke fail.