We have an issue with routing for sites that are connected as 'spokes' using site-to-site VPN. If the 'default route' box is not checked, these spoke sites can only access the subnets advertised by the hub they are connecting to. All subnets in the rest of the mesh are inaccessible.   If the 'default route' box is checked, all subnets are accessible however this sends all traffic across the VPN to the hub which is not what we want. We wish for traffic to break out at the local Internet link if they if it is not destined for a network inside the VPN.    Using the packet capture, I can see that traffic destined for VPN subnet (beyond the hub) is sent out of the Internet interface rather than the site-to-site VPN interface. This is why it is not working. So it is as if the route table is not correct on the spoke end.   Packets originating at the other end (from a VPN subnet beyond the hub) make it all the way to the spoke site, but obviously the reply is lost due to the above.   Is there something I am missing here?   Spoke sites are MX64s on 14.40.    ... View more