We typically solve this issue using Ubuntu and Strongswan (when you can't deploy vMX).   Basically you configure Strongswan to only accept VPN's, not make them.  It then matches on the subnets in the SA negotiation.  Then you can have lots of branches using non-Meraki VPN directly to the Ubuntu box. ... View more