Let’s start at the beginning: there are two ways that the Auto-VPN can work, either Full Tunnel or Split Tunnel. In Split Tunnel mode traffic is only encrypted into the VPN tunnel if it’s destined for a subnet advertised by another node on the Auto-VPN. In Full Tunnel mode all traffic leaving the site is encrypted into the VPN tunnel and sent to the hub site, where it is then decrypted and forwarded on. The VPN Full Tunnel Exclusion (breakout) applies only to the Full Tunnel mode and allows you to exclude specific destinations from the full tunnel. For your scenarios: In the initial one you could use Split Tunnel mode so that only traffic destined for an internal subnet is sent over the VPN on the MPLS link, and then use an Internet Flow Preference to send all internet traffic over the direct internet link on the second WAN link. There is no need to use the Full Tunnel Exclusion (breakout). If you do use a Full Tunnel and an Exclusion the internet traffic would be sent based on the Internet Flow Preferences. Incidentally you could also send the internet traffic unencrypted across the MPLS link so it is sent via the hub, and you could also use a VPN Tunnel over the direct internet link, these could be for failover of flow/performance based - this is the essence of a SD-WAN solution. The the second scenario, as you say, is straightforward. You can use Split Tunnel or Full Tunnel, and if you do Full Tunnel you could use the Full Tunnel Exclusion (breakout) feature. For the third scenario to work (which also applies to the MPLS link in the initial scenario) there must be a path to the internet from the MPLS underlay, not just the overlay. This scenario is pretty much as you describe, all traffic goes to the exit hub, the difference will be whether it is encrypted or not which has an impact on the CPU/utilisation of the MX device. Internet traffic will still be passed over the MPLS link in Split Tunnel mode or with a Full Tunnel Exclusion (breakout), it will just be unencrypted, it would not be dropped. Although if you wanted to you could configure the underlay to drop this traffic, so long as there is still access to the Meraki cloud. Hope this explains it a bit more.
... View more
