Hey @luckyphill, The VPN registry is responsible for providing peer information to all of the MX's participating in the AutoVPN. Since it looks like the connectivity is good to the VPN registry servers, you'll want to focus on the traffic between the two peers that are unable to connect. Specifically, you'll want to make sure that both devices are able to communicate to one another via the public IP and port that is identified on the VPN status page under the 'NAT Type: Friendly' section. If the devices are behind a NAT, which looks to be the case, you would check and make sure they can reach other via the NAT'd IP and port. For the spoke, it looks like at the very least it is communicating over UDP port 33333 and the Hub is communicating over UDP port 44377. To verify they can communicate, I would start with a packet capture on the active WAN interface of both MX's and confirm there is bidirectional communication between the two. If you're seeing unidirectional traffic on one end, that'll help you identify where the problem might be (routing, traffic filtering, etc.).
... View more