Hi ,   One-Armed Concentrator This configuration utilizes an MX device configured to act in VPN concentrator mode, with a single Ethernet connection to the upstream network. All traffic will be sent and received on this interface. This is the recommended configuration for MX appliances serving as VPN termination points into the datacenter. https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide   I don't think that is supported. You will have to run a warm spare if you want redundancy  ... View more

With 20+ sites I would always put an additional MX-Pair as a concentrator into the DC and use AutoVPN. It will make everything so much easier. Otherwise, I would go with the "one peer" approach. Although using wildcard PSK is not a best practice, the main problem with them is the logistics problem when the PSK is compromized. But this is not the case with the cloud based config where the PSK can be easily changed for many devices simultaneously. ... View more