After weighing options like spinning up a csr1000v and other things, we decided to implement an ASAv firewall in AWS.  This could be done with PaloAlto and other devices.  This gets us around the need to do BGP peering as we have done in other traditional data centers.  This should satisfy the routing issue by having a single default route from the vMX to the firewall and the firewall with a default route to the Internet and routes to our internal AWS resources.  We also have an ASAv that is used for RA-VPN in AWS so putting both the vMX and the RA-VPN ASAv into a DMZ made a bit more sense for us.  This provides an additional layer of security outside of what we may have configured with the AWS Security Groups.    Below is a basic diagram for anyone else looking for a deployment solution for vMX in AWS.     ... View more

I opened a case with Meraki TAC.    We have multiple orgs, but only 1 org contains the access points. The other org is legacy from an acquisition.   I had assumed that the only place that the "Login IP ranges" needed to have the external AWS IP address was the org that contained the APs.  After adding that same AWS IP to the other org, Orion was able to pull the list of orgs to where I could select the one that had the APs.   The solution is to ensure that the public IP Address from Orion is entered into the Login IP ranges in all orgs if one has multiple orgs. ... View more