Correct, the issue arises due to asymmetric routing, as return traffic exits at the POP within the Secure Connect data center. Unfortunately, in some cases, it’s not possible to exclude these IPs from the VPN or configure them as a hub. This limitation is a significant blocker for us in adopting Secure Connect, and we hope it will be addressed in a future update. ... View more

Clients connecting to the vMXwith Secure Client  can only operate in split-tunnel mode. This means they can access all announced networks in Azure and those behind the spokes but cannot route traffic to the internet through the vMX. ... View more