Default route internet access within service VPN

[HarrySandars]

Hi all,

I was wondering if someone could advise on this please

Is it bad practice to have an internet breakout (default route) within a service VPN as opposed to in VPN0? I understand tunnels and control connections won't ever be formed through this internet breakout but that is not required. The reason for doing this is so traffic can hit the firewall with the source address intact rather than being overwritten by NAT that occurs when breakout out from service VPN -> VPN0 as well as to allow traffic within this site to take a more efficient path rather than all internet traffic being routed via the cEdge, and finally lowering complexity in adding the edge to this network. 

I know it works in a lab environment

Cheers

[Kanan Huseynli]

Hi,

technically looks normal way. In general, it is OK to have two different devices for different exit points: one for WAN, another for internet exit point. If you have main-core switch on site, you may route directly to firewall rather than hairpinning via cEDGE.

HTH,