Hello, I'm attempting to connect to a remote vendor subnet via a passthrough MX appliance. After some research, it appears this is not possible using static routes. I did switch to using a BGP IPsec tunnel between our own MX appliances but that also presented a challenge. On the very bottom of the IPsec BGP Deployment Guide, there's a footnote that says Note: Statically defined local routes configured on passthrough MX devices are not exported to the eBGP peer over IPsec When I tried the BGP tunnel, the local Azure LAN and remote vendor subnets were not exported to the on-prem MX250. Our vMX and MX250 are not AutoVPN peers as the MX250 is part of an old organization. I feel like the only way to solve this is to enable BGP on the IPsec tunnel with the Vendor (unfortunately not an option here) and move the Azure LAN stuff to a completely different firewall that's part of our AutoVPN deployment. Am I off in left field? Here's a drawing that helps explain my problem. Thanks for reading.
... View more
