@Rob York Thanks for the reply. I found your previous comment, Workaround is to make an MP available to the VPN boundary. Adding an internal MP to my VPN boundary group along with the CMG seems to work.