Here it is: Cisco Meraki Best Practice Design - Cisco Meraki   Under the "VPN Registry" chapter:   The process for adding a new MX into an infrastructure is as follows: A new MX reports its uplink IP address(es) and shared subnets to the registry The information is propagated to the other MXs in the infrastructure The MX establishes the proper VPN tunnels The MX will try the registry-reported private uplink IP of the peer first If a connection to the private uplink IP of the peer fails, the MX will try the public uplink IP of its peer   I didn't spot this document, it is basically the root of all the other design documents 😆   I'm gonna read it all! ... View more