Hi, I am looking to replace 2 ISR 2900s at one of our branches with a pair of MX67s as part of an SD-WAN pilot. We'll provision a pair of MX100s in our DC. We currently have diverse carrier MPLS links at the branch, with 1 link terminating on each of the 2900s. The carrier links are using /30s and we use BGP to advertise the sites routes to the carrier. Connectivity from the current WAN routers to the LAN routers use /30s and run EIGRP on the LAN side. As part of the pilot, we'd like to install a new business grade internet link for offloading DIA (as well as the secondary SDWAN path), and after the a pilot, decommission one of the carrier MPLS links.    When looking at the MX HA docs, I believe that I would need to make the following changes. I want to double check that there aren't any other things that I need to consider.   - Only the primary MX in the HA pair forwards the production traffic, so to utilise both the MPLS and the internet link, as well as have automatic failover, I'd need to have the MPLS and internet links terminate on both the primary and redundant MXs. To achieve this either request the carrier to provide a second uplink from their NTU and bridge the 2 connections on their side (if even possible), or add a WAN-side ethernet switch that would sit between the MX and the carrier NTU to provide the L2 connectivity (additional point of failure). Alternatively I could use the existing LAN switch to cable the carrier links and the MX WAN link in and provide the connectivity that way (seems messy).   - Transition the existing carrier MPLS connectivity from a /30 to a /29 to accommodate the connectivity from the second MX. The new internet link would be ordered with a /29. This would ensure that both of the MXs have external connectivity to reach the cloud for mgmt and for uplink connectivity tests. I'd then configure WAN virtual IPs between the HA pair. Is an AutoVPN tunnel established from both the primary and standby MXs?   - Change the routing to the carrier from BGP to static routes. The MX doesn't need dynamic routing anymore as it's failover is based on the MX HA, and the path selection is done via policy within the dashboard.   - I will need to transition the /30s from the WAN to the LAN routers to /29s as the MXs use VRRP to talk on the LAN side as part of the HA heartbeat. The routing from the LAN switch would need to change to use static routing with the downstream LAN device pointing to the LAN side VRRP address. Can I use routed mode on the MX LAN or do I need to use Vlans?   - What visibility do I have of the default firewall protection policy on the internet link that will terminate on the MX? Currently all internet traffic is bought back to our DC and exits via a central egress. The security is controlled by Checkpoint firewalls so our policy is well managed, visable and logs from Checkpoint are quite good.   Any other points that I am missing?   Cheers ... View more