Thanks GldenJoe for clarifying this.  ... View more

You can actually create one IPSEC tunnel to 3rd party vendor on the hub mx and then create a static route to advertise the IPSEC remote subnets to the spokes mx/sites.  ... View more