I've really been having a tough time getting the design right for this project and could use some help. We have a headquarters with an HA pair of MX105, and an HA pair of Palo Alto Firewalls, and 2 Internet providers. There are 4 local private subnets. We have a remote Data Center with another AH pair of MX105, an HA pair of Palo Alto Firewalls, and one Internet from the DC. There are 2 local private subnets. We have 5 branch offices each with a MX75 and 1 (sometimes 2) Internet providers. Each branch has 2-3 local subnets. There is a Metro-E layer2 connection connecting all sites. The goal is to have all internal traffic flow across the Metro-E when available, and via the AutoVPN connections when it is down. We want all user Internet traffic to flow through the Palo Alto at HQ, and fail over to the Data Center if HQ loses both ISP. No user Internet traffic should ever directly exit the Meraki, only through the Palo Altos. My original design had WAN1 at each location connected to the ISP, and WAN2 connected to the Metro-E. The Metro-E WAN interfaces had a default gateway pointing to the Palo Alto for Internet access. This works, except that I can't figure out how to have the Data Center MX105 have a 0.0.0.0/0 route pointing to the local DC firewalls for the purpose of being the backup internet connections should HQ fail. As soon as I add a 0.0.0.0/0 route the Data Center can no longer reach the HQ private subnets because the static route takes precedent over the AutoVPN routes, so I get a routing loop between the MX and the local firewalls. If I have the MX105 learn the 0.0.0.0/0 route via BGP from the firewalls the MX105 start sending the Internet traffic directly out its own WAN interface because the external BGP route is lower priority. I was starting to look at converting the HQ and DC MX105s to be one-arm concentrators (as has been suggested since I don't want any Internet traffic exiting them directly) but I can't figure out how to have the primary path between sites be the Metro-E and only use AutoVPN as a backup. One-arm concentrators only have one default route. I don't feel like the overall goal is asking all that much, but I can't seem to find a design that ticks all the boxes. Any insights would be greatly appreciated!
... View more
