Can't attach device interface to multiple VPN tunnels #9033

Closed
opened 2025-12-29 20:44:25 +01:00 by adam · 3 comments
Owner

Originally created by @dirtycache on GitHub (Jan 3, 2024).

Deployment Type

Self-hosted

NetBox Version

v3.7.0

Python Version

3.8

Steps to Reproduce

  1. Create VPN -> TunnelA
  2. Create termination for TunnelA and attach to Device Interface ("wan")
  3. Create VPN -> TunnelB
  4. Create termination for TunnelB, attempt to use same Device Interface "wan" as TunnelA termination
  5. Fails: wan is already attached to a tunnel (TunnelA)

Expected Behavior

It is possible to attach multiple IPsec tunnels to a single interface on the device; this should be permitted in Netbox as well.

Observed Behavior

Create termination fails: wan is already attached to a tunnel (TunnelA)

Originally created by @dirtycache on GitHub (Jan 3, 2024). ### Deployment Type Self-hosted ### NetBox Version v3.7.0 ### Python Version 3.8 ### Steps to Reproduce 1) Create VPN -> TunnelA 2) Create termination for TunnelA and attach to Device Interface ("wan") 3) Create VPN -> TunnelB 4) Create termination for TunnelB, attempt to use same Device Interface "wan" as TunnelA termination 5) Fails: wan is already attached to a tunnel (TunnelA) ### Expected Behavior It is possible to attach multiple IPsec tunnels to a single interface on the device; this should be permitted in Netbox as well. ### Observed Behavior Create termination fails: wan is already attached to a tunnel (TunnelA)
adam closed this issue 2025-12-29 20:44:25 +01:00
Author
Owner

@jeremystretch commented on GitHub (Jan 3, 2024):

This is not supported. You need to create a separate virtual interface for each tunnel.

@jeremystretch commented on GitHub (Jan 3, 2024): This is not supported. You need to create a separate virtual interface for each tunnel.
Author
Owner

@dirtycache commented on GitHub (Jan 3, 2024):

That would work fine if terminations were assigned to logical vti interfaces, aka the tunnel "inside" addresses. But this is the termination, with the "outside" addresses. The wan interface holds the outside address, and there is only one.

Perhaps I'm not understanding how one would document the IPsec outside addresses while needing to create separate virtual interfaces -- essentially dummy interfaces just for the purpose of the tunnel termination?

@dirtycache commented on GitHub (Jan 3, 2024): That would work fine if terminations were assigned to logical vti interfaces, aka the tunnel "inside" addresses. But this is the termination, with the "outside" addresses. The wan interface holds the outside address, and there is only one. Perhaps I'm not understanding how one would document the IPsec outside addresses while needing to create separate virtual interfaces -- essentially dummy interfaces just for the purpose of the tunnel termination?
Author
Owner

@jeremystretch commented on GitHub (Jan 3, 2024):

If you need assistance modeling tunnels, please open a discussion.

@jeremystretch commented on GitHub (Jan 3, 2024): If you need assistance modeling tunnels, please open a [discussion](https://github.com/netbox-community/netbox/discussions/new/choose).
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9033