I can understand why your provider has it provisioned that way, but that is not a normal use case for the MX. I'm surprised you got it working at all. Typically site to site VPNs are only used to access local VLANs in the Meraki MX world, and not remote networks (like the Internet). When I have done this previously I have used a little Cisco router (like a 1111-4P) and terminated the APN VPN on that. https://www.cisco.com/c/en/us/products/collateral/routers/1000-series-integrated-services-routers-isr/datasheet-c78-739512.html You would then add a default route on that pointing to your MX and a route for your APN on the MX pointing to the router. Another option would be to use a second MX (it would have to be in a different network), and terminate the APN VPN on that, and have its default route pointing to your primary MX, and your primary MX would have a route for the APN pointing back to it. You could also consider asking the provider to connect the APN to the Internet and use something like Cisco Umbrella on the mobile devices to provide the protection. Then a lot of the complexity dissappears. This document talks about routing behaviour. It only partially covers your case. https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior
... View more
