Which VLAN is used to source pings across the site-to-site VPN when using the MX Live tools?

When using the Meraki MX Live Tools to ping a destination across a site-to-site VPN, the MX appliance must select a source IP address from one of its local VLAN interfaces. The documented behavior for this operation is that the MX will specifically use the IP address of the VLAN with the highest numerical ID that is configured to participate in the site-to-site VPN. This ensures the source network is advertised to the remote peer and that return traffic is properly routed back through the VPN tunnel.

A. The source VLAN must be configured to participate in the VPN; a VLAN set to "NO" cannot be used.
B. The selection logic uses the highest numbered VLAN ID, not the lowest, among those participating in the VPN.
D. This is incorrect on two counts: the VLAN must participate in the VPN, and the highest ID is used.

1. Cisco Meraki Documentation, "Using the Ping Live Tool". In the section "Source IP Address," the document states, "When pinging a device across a site-to-site VPN, the MX will source the ping from the highest numbered VLAN that is configured to be part of the VPN."