Thanks @RyanB, this totally makes sense. One of the reasons the idea of terminating at the "core" stuck with me is because eventually (hopefully), i'll be deploying a second MX250 as a warm spare and I wanted to build a foundation/standards for the way we'll be doing WAN links. I would terminate at the core (single port) and then I would split out from the core into each of the respective WAN ports on the MX pair. And I think your suggestion of not having to tag the WAN port makes good sense. This might get forgotten or overlooked down the road and will send future me or next admin for a loop, no pun intended 🙂   Another reason to terminate at the core is flexibility in my opinion and please feel free to poke holes in this as much as you please....If we ever have to swap out the firewall and go to a completely different vendor (long shot), we'd be able to set up the devices along side production and failover somewhat seamlessly.  Possibly down the line, if this tiny branch office network expands, I could potentially enable L3 and involve my core in some routing decisions (again, long shot).   My last question for you If I may, is regarding the routing table and the default route. At this point, I should have 2 direct routes, both default, from each of the ISP's and another direct route from the LAN interface(granted there is only a single flat VLAN for local) In order to be able to manipulate traffic, I believe I would modify the Primary WAN option within the MX interface to change the metric for which route traffic would be going out of. Do I need to setup any static routes? How do I specify the default route config or is that automatic and handled by the MX?   Thanks again, This was seriously helpful     ... View more