That setup of using a vpn termination point behind physical mx and then using static routes or bgp works.   I supose it could also work on a vmx.  ... View more

Hi Gary,   Could the VMX in passthrough mode still use BGP to propogate Azure routes? ... View more

You could deploy the Umbrella virtual appliances on-premise if you would like to keep the same functionality.   But it doesn't sound like you really have an issue.  You can just use Umbrella for enforcement and tracking of the users, rather than the MX. ... View more