thank you very much for this.  after speaking with support the only real thing I was missing was a static route for the new vpn client subnet.  this needed to be added on the UDM to add a static route with the vpn client subnet and set the MX67 as the gateway (or next hop).  once this was done, traffic to everything was good.  nothing more really had to be set on the MX67.    thank you and everyone else for their assistance. ... View more