Hello all, I have a hub-to-spoke design that I need to implement for a client where which is somewhat straightforward, however I've never done this design before so would appreciate if anyone could validate. The client has a requirement to tunnel all publicly destined traffic through their existing internet perimeter firewalls which has IPsec VPN tunnels to a cloud on-ramp web security service. Therefore my logic is to configure hub as the following priority & settings: Primary MX hub will be implemented in Split Tunnel mode (greenfield DC CoLo environment) Secondary MX Hub will be implemented in Full Tunnel mode with "Default Route" option selected (existing HQ Office, also regarded as customers existing DC environment). Secondary MX hub will also need to be in routed mode. Would this configuration work, so spokes for e.g would transit 10.x.x.x/8 networks via primary hub? And any network traffic destined to public addresses would transit via secondary hub, since the default route option is selected and static routes downstream to core switches/firewall are explicitly configured on secondary hub? I've based this logic as per documented (from Site-to-Site VPN doco) behavior when Default Route option is selected Also done up a quick high-level diagram for further detail of proposed setup.
... View more
