FYI, a customer faced the same issue and the problem was his ZScaler endpoint agent blocking the traffic. ... View more

https://en.wikipedia.org/wiki/Rogue_access_point ... View more

I'm not sure about Google Cloud specifically, but most cloud providers (AWS/Azure) do not route private subnets behind the vMX (for example the client VPN subnet in this case) out to the internet. However, VPN clients are still able to access cloud resources if you configure routing correctly. You can (1) Split tunneling; or (2) Turn the vMX to NAT mode, which is the default mode when you first spin it up. More info here: https://documentation.meraki.com/MX/Other_Topics/vMX_NAT_Mode_Use_Cases_and_FAQ ... View more

I see. didn't take the Azure remote subnet into account.   Thanks to you all... I will def look into the vMX.   ... View more

^^^ you would need to open a case with Support to have "no hub to hub" enabled ... View more

NFO is an internal-only term used to describe a feature that can only be enabled by Meraki (customers have to call into support) ... View more