I could probably write a chapter for a book answering this question. To make the answer shorter I can going to assume: The hub will be active/wam spare (not active/active or dual DC). There are less than 1500 spokes. There is no MPLS. There is only AutoVPN over the Internet. You would probably use One armed VPN concentrator mode if: You have an existing firewall. You have an HA Internet setup. You have a layer 3 network core You need BGP or OSPF support exchange routes. You would probably use NAT mode if: You can plug the MX into more than one Internet circuit so the MX can provide Internet HA itself. You need to support clients behind the MX accessing the Internet, or you want to be able to apply Meraki group to those users. Personally, I mostly use NAT mode myself. I mostly do deployments with less than 200 spokes. I nearly always use the DC's primary Internet connection, and get another "out of band" domestic grade Internet circuit in case of catastrophic failure. I call it cheap insurance. I also avoid using dynamic routing in Meraki deployments (I like to keep them Meraki simple). I would also like to recommend the Meraki MX sizing guide by Aaron Willette, which you should regard as a Cisco Meraki God. http://www.willette.works/meraki-mx-sizing/
... View more
