How to use VPN-Feature with external VPNs, and not make a device and Site for every customer.

[Thor-cb90]

Hi,
to be specific, i have 200+ VPN-Tunnels to handle/document here, and until now, i've used "Circuits" for that.

I've made some custom fields for our needs to use circuits for that, as you can see.
In the new VPN-Feature i'll do the same, BUT i have to link a device for each Termination, for which i have to link a site to and so on..
Is there another way to handle this, or do i have to do a workaround (as in SIte "external customers" and Device "default Firewall") ?

[markkuleinio]

For the bulk of the external tunnels, I'm planning to use something like this:

• a dummy site like "Remote L2L peers" (used for most tunnels; for some "important" cases I can use the real site if created)
• a device type like "Unknown" (when the actual remote device type is not known or we don't care)
• tunnel name is the name of the partner, like "LeiniöCompany"
• device name is "LeiniöCompany-peer"
• the device has one virtual interface "Internet" with the peer's public IP

(edit: unless I just use object-type custom fields to save the necessary details directly in the tunnel object)

There is another discussion at #14666 as well, check that out.

[Thor-cb90]

Hi Markku,

how do you handle multiple SAs in the same Tunnel?
I've made a custom field when i used Circuits, but in the VPN i did not find any fields for that.
Or ist that the field "Outside IP", so that i make a termination for each SA?

Thorsten

[markkuleinio]

As I understand it, the current implementation of NetBox' VPN tunnels is directed towards handling only route-based VPN tunnels where only one SA is used (for 0.0.0.0/0 <--> 0.0.0.0/0, based on routes pointing to the tunnel interface). Thus, if you need to document policy-based tunnels or anything "not just one tunnel between the devices", you need some custom fields or other customization.

In 3.7.0 there is a limitation that only one tunnel can be terminated on the same Outside IP, but that limit is being relaxed in PR #14711 so hopefully the fix is included in NetBox 3.7.1.

[chuegel]

So to understand this correctly: the VPN feature does NOT support encryption domains? Most of our VPNs are policy-based.
Is there a feasible way to model policy based tunnels?
Thanks