Yes, This was stated in the documentation.https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Troubleshooting_and_Support/Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page/Cisco_Meraki_Local_Status_Page%3A_Secu...

In the case of Meraki's Auto vpn, the following port range is used to contact the VPN registries for the first time. After that, UDP communication is performed to each other's global IP using the following port range as the source. This uses UDP hole...

As everyone here has said, I don't think there is a minimum MX license restriction.This is with Secure connect, you can use Umbrella features such as remote access etc, but you can use it without an MX.However, Secure connect requires a separate lice...

For an one arm concentrator, I think it is correct that the default gateway points to the FW.It also needs to be separate from the client subnet as described in the following document.https://documentation.meraki.com/MX/Site-to-site_VPN/One-Armed_VPN...