How do you model the remote side of B2B site-to-site IPsec tunnels in NetBox?
Hi all,
I'm documenting our site-to-site IPsec tunnels in NetBox (4.6.4). For tunnels between our own devices it works fine: two terminations, each with a device, an interface and an outside IP.
The problem is B2B tunnels to external organizations. The remote gateway isn't ours, we don't manage it and know almost nothing about it except the peer IP. But a tunnel termination has to point to an interface on a device or VM, and the outside IP has to be assigned to that device.
Options I'm considering:
Create the tunnel with only one termination (our side) and put the peer IP and partner name in the description/comments. Simple, but the peer IP is just text, so it isn't searchable as an IP object.
Create a placeholder device per partner (dedicated site, a role like "External VPN peer", a generic device type), add one virtual interface, assign the peer's public IP as a /32, and use it as the second termination. Then tag the device, the IP and the tunnel so it's obvious these aren't real managed devices.
Option 2 looks cleaner to me, but I'm worried about polluting the device inventory with fake devices (device counts, reports, anything that syncs from NetBox to monitoring).
How do you handle this in production?
- Placeholder devices, a single termination, custom fields, something else?
- If you use placeholders, how do you keep them out of monitoring/automation that reads from NetBox?
- Anything you regret about the approach you chose?
Thanks!