When running either an MX or vMX in concentrator mode you need something to perform NAT to the internal network where the MX/vMX is sitting. This is typically another firewall. The firewall is not their to protect the MX/vMX. MX's on MPLS tails using AutoVPN over MPLS need to have the same public IP address as the concentrator where the MPLS circuit access the Internet. A firewall provides this.
... View more
