Sweet! I'm glad it worked out ... View more

So, what was the issue? ... View more

@DCooper It worked but I do have additional questions. (Both MX on NAT mode) I set it up to where Branch has WAN1 connected to ISP, WAN2 connected to Metro-E with static IP that sets gateway to HQ's Metro-E Static IP. I set DNS as 8.8.8.8 and HQ MX IP.   On HQ side, I connected Metro-E directly to LAN5 port with vlan XXX  (I didn't have to tag vlan on Branch's WAN2 port. It did not form VPN when I setup vlan tag with XXX.)   I had to take off a static IP route I had for Branch office on HQ side to form VPN with Branch office.   Branch office has primary uplink set as WAN 2 (metro-E) with disabled load balancing. I did setup preferred uplink with TCP Any to ANY to WAN1, so all internet traffic will override primary uplink.   On VPN status>Uplink decisions: Majority of my VPNs are using WAN 1 with reason: "Performance-based" I do see some WAN2 with reason "Primary Uplink". I did not setup any performance class under traffic shaping.   So, here's my question: 1. What is the determine factor for reason "Performance-based"? 2. It looks like I setup this setting pretty accurately. Did I miss anything?   I am hoping with this setup that I can have failover for both WAN and Metro-E traffic. Previously we were only able to have Metro-E failover.   By the way, @PhilipDAth This is what I came up with it. ... View more

So, a branch would connect Metro-E/MPLS connection on WAN port and set gateway to HQ MX metro-E/mpls ip address. And on HQ MX on NAT mode connects Metro-E/MPLS on one of LAN port to create auto-vpn? I assume this needs to be on Hub-Spoke vpn setup with HQ being the hub. If a branch has an ISP connection on WAN 2, we will be setting it up with active standby where WAN 2 would be active like the documentation you linked.   Previously on version 12.26, when I tried to attempt this, Branch's WAN1 was not forming VPN on HQ MX. I am guessing because HQ MX had connection on LAN port. Branch recognized WAN2 as only available vpn link despite vpn preference setting.   Am I correct? ... View more

Under 13.3 release note ... View more

So with our setup, we cannot have a backup route to internet if branch's WAN goes down? ... View more

I thought about that design, where it provides backup internal route through auto-vpn. This scenario works with metro-e connected to MX's lan port on both branch and HQ site.   But with this scenario, doesn't it only provides failover to metro-e?  What if my branch's uplink 1 goes down, and it does not have WAN2, can I setup static default route to go to HQ metro-E? ... View more

That's how we set it up at one of our branch office. We connected Metro-E on WAN2, then setup traffic shaping to set WAN2 as primary uplink without load balancing, but the according to vpn status, it's forming an auto-vpn with WAN1 instead of WAN2. WAN2 connection is setup to set gateway to HQ metro-e ip address.   HQ mx has metro-e on LAN port because its WAN1 and WAN2 has separate uplink ISP.  ... View more

Have you guys figured this out?   We have a very similar scenario at our site.   We currently have MPLS connecting 6 locations. Routing is done by our ISP.    We are moving away from MPLS and recently starting to implement Metro-E at our locations. Each location has a designated cheap uplink. Currently I am using each location's core L3 switch to do failover routing for both MPLS/Metro-E and uplink ( I wanted it to use MX auto-vpn if MPLS/Metro-E goes down and if local uplink goes down, send default route to MPLS/Metro-E). Ultimately I want to move all these routes to MX, so I only need to manage local L3 routing on Core switch.   I attempted to setup this configuration, https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS, on our sites, but branch keeps forming autovpn over its own uplink instead of over Metro-E.   Did anyone figured this out?    By the way, the HQ has two uplinks and Metro-E connection. ... View more