How about trying the following?   Look at the following red square. If you specify one device to be your default route, all traffic will be routed there by default. As for getting your internet traffic over the WAN internet interface, perhaps the following Allow ACL list would fix that: 0.0.0.0/5 8.0.0.0/8 9.0.0.0/8 11.0.0.0/8 12.0.0.0/8 13.0.0.0/8 14.0.0.0/8 15.0.0.0/8 16.0.0.0/8 32.0.0.0/3 64.0.0.0/2 128.0.0.0/1   Cheers, ... View more

>>>still have to reset the tunnel in the ASA side every now and then (random) as we don't know what's going on and it is really frustrating.<<<   Have you tried using some kind of keep-alive ping or other traffic from the LAN side of your Meraki to the WAN/VPN side say once every 5 minutes? ... View more

So all the central data center VPN Concentrators would also have to be replaced.   Isn't there a way to configure spokes with non-Meraki devices?   ... View more

>>>No, because you wouldn't configure 15,000 locations as hub sites.   At that scale, you would probably have some core hubs, some regional hubs, and the rest would be spokes connecting to their regional hubs.<<<   But if there are already 20 non-Meraki VPN Concentrators up and running in the data center which currently link up all 15,000 non-Meraki VPN locations. And you wanted to roll out Meraki MX65's over a 3 year period of time to all of those locations, the VPN Concentrators would still be a non-Meraki device and as such, you could not configure them as a Spoke because only Hubs can be selected with non-Meraki devices.     ... View more

Regarding your comment: >>>all hubs will form a VPN to all other hubs automatically. You can't stop that.<<<   So you're saying that if I have 15,000 locations, that all 15,000 locations will automatically VPN to the other 14,999 locations?     ... View more

Are your ASA Sec Lists and Meraki's VPN subnets exactly the same? ... View more