Azure vMX VNETs for Internet and LAN Port – Segmentation

So we have started to Deploy vMXs in Azure in Routed mode with an Internet and LAN Port. 

One drawback I’ve identified is that you must use the same VNET for both ports. The Wizard doesn’t allow different ones. I wanted to put the MX internet on a completely separate un-peered VNET for security reasons. 

I think my primary option is to develop rules via NSGs to block LAN subnets from the WAN subnet and vice versa.

Has anyone else noticed this? Am I missing something obvious? Seems like it would be a simple fix for Meraki to update the templates to allow this.

Do other public clouds have the same issue? We aren’t going to be changing but curious.

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.