Hello everyone, We are having huge losses with our vMX appliance installed in Azure, first let me introduce the scenario in order to further understand where the problem stands. Below you can find the rough topology which I built for this question: 1- We have a vMX-M appliance created in Azure, which is running in VPN Concentrator/passthrough mode with one interface (one armed architecture) having a private (172.16.0.4) and public IP address at the same time. There are S2S VPNs in place with spoke branch offices as seen from the picture above and these site to sites are UP and running without any issue. 2- In Azure environment, at the same subnet of 172.16.0.0/28 there is built a NVA appliance (palo alto FW) with one interface at the same subnet as vMX appliance and having an IP address (172.16.0.5).  3- Behind this FW appliance, there are resources to be accessed from the branch offices (with IP range 10.20.0.0/16, splited in smaller subnets for each branch office).  Saying that we have a route table attached to the common subnet between PaloAlto FW and vMX-M appliance which have the following routes: a) DST: 172.16.0.0/16  Next-Hop: 172.16.0.5 b) DST: 10.20.0.0/16  Next-Hop: 172.16.0.4 However, this is creating big looping issues where we see packet drops sometimes at high amount which affects some working processes in the communication between branch offices and azure resources.  I tried disassociating the route table from the subnet used in common between Palo Alto FW and Meraki vMX and started a contionous ping from branch office to the vMX appliance internal IP address (172.16.0.4) and there are no drops at all. However, the removal of this route table affects the communication from branch offices to the Azure resources where it seems vMX appliance is unble to route the traffic to the PaloAlto FW without this route table.  I tried to find a way to manually add the routes in the Meraki dashboard but since the appliance is running in Passthough mode I was unable to insert a static route (so not possible for this mode).  My question would be if somebody knows any way how to route the traffic from vMX to NVA (PaloALto FW) without the insertion of route table ? p.s. I also tried OSPF but it did not work.  If not, then is there a better way to solve this problem which we are facing in that specific scenario ?  Thank you in advance ! ... View more