Going completely sideways (because others have already given good answers);   This configuration can be much more robust by getting your customer to buy one additional MX, running it in VPN concentrator mode, and hosting that at your DC. You would then treat this device like an MPLS router.  You create static routes from your ASAv to it.  It routes everything to its default route (on your side).   https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide   A baby MX67 can manage 400Mb/s of AutoVPN throughput when in VPN concentrator mode (low cost barrier). https://documentation.meraki.com/MX/MX_Sizing_Information/MX_Sizing_Principles#Performance_Data   ... View more

This can work if you have a routed block from the ISP, however that doesn't appear to be the case. If you are not meraki users I would just remove the meraki and connect your sonicwall directly. Probably will have to put it somewhere secure so you can return once you the contract is up and you are able to renegotiate to DIA only.  There may be other solutions but I would operate on this like when FiOs almost always ships a router that is unnecessary, remove it and do your thing the way you want. Might have to turn off some alert emails but I wouldn't think att will care.     ... View more

You can only form IPsec VPN's over the WAN IP's of an MX.  So if both firewalls exist next to eachother behind an upstream router then you could easily have an IPsec VPN between them even if their WAN IP's are in the RFC1918 range. However if the Palo Alto is at the LAN side of the MX you will be out of luck. ... View more