Seamless roaming will only occur between APs on the same Meraki network. When roaming between APs in different Meraki Networks, the IP address, policy, and PMK for each client is not shared, resulting in a hard roam where the client devices must fully reauthenticate.    In fact, if you have APs in the same physical proximity, using the same SSIDs but on separate Meraki networks, Air Marshal may trigger an SSID spoofing alert.    For a more in-depth explanation of Roaming Domains and the behavior with Meraki APs along with general Best Practices for Wireless Enterprise deployments with Meraki, I would highly recommend giving this document some time:    https://documentation.meraki.com/Architectures_and_Best_Practices/Meraki_Wireless_for_Enterprise_Best_Practices_-_Architecture   ... View more

That is correct, security inspection such as Content Filtering and Threat Protection is done locally on the MX. The hub/concentrator MX will not inspect traffic from the remote VPN subnets.   You can find this information referenced here: https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering_and_Threat_Protection_over_Full-tunnel_Site-to-site_VPN     ... View more