Hi There, The simplest solution would be to keep the MPLS interface in the same VR as the others and put it in the Trust zone. This way your networks will route and nat just like the local LAN traffic and you don't need any security policy for traffic to flow between sites. If you use a different zone, you will need to allow the traffic with a security policy. If you use a different VR, you will need to somehow route between them. Today that would require a physical cable between VR's and static/dynamic routes. I would not recommend doing this. Since there is only a single connection to the MPLS cloud, the easiest routing solution would be to configure one or more static routes out to the MPLS next hop in the same VR as the other links. You could also use a dynamic routing protocol if your provider supports it and you are currently using that for your other sites, but there is probably no point since there is only a single connection. Hope that helps. Cheers, Kelly
... View more
