r/Netbox

Hi all,

I'm documenting our site-to-site IPsec tunnels in NetBox (4.6.4). For tunnels between our own devices it works fine: two terminations, each with a device, an interface and an outside IP.

The problem is B2B tunnels to external organizations. The remote gateway isn't ours, we don't manage it and know almost nothing about it except the peer IP. But a tunnel termination has to point to an interface on a device or VM, and the outside IP has to be assigned to that device.

Options I'm considering:

1. Create the tunnel with only one termination (our side) and put the peer IP and partner name in the description/comments. Simple, but the peer IP is just text, so it isn't searchable as an IP object.

2. Create a placeholder device per partner (dedicated site, a role like "External VPN peer", a generic device type), add one virtual interface, assign the peer's public IP as a /32, and use it as the second termination. Then tag the device, the IP and the tunnel so it's obvious these aren't real managed devices.

Option 2 looks cleaner to me, but I'm worried about polluting the device inventory with fake devices (device counts, reports, anything that syncs from NetBox to monitoring).

How do you handle this in production?

- Placeholder devices, a single termination, custom fields, something else?

- If you use placeholders, how do you keep them out of monitoring/automation that reads from NetBox?

- Anything you regret about the approach you chose?

Thanks!

Deleting a device record makes the current inventory cleaner, but it can also remove context that is still useful during a decommissioning window. Interfaces, IP assignments, cables, circuits, rack position, virtual machines, cluster membership, monitoring references, configuration backups, and automation jobs may still point to the device even after production traffic has moved. Discovery or reconciliation tooling may also recreate a deleted object before the physical asset is actually gone.

A safer lifecycle could move the device through planned, draining, offline, and retired states. Automation would stop treating it as a deployment target, but the record and relationships would remain available while connection logs, monitoring, and discovery are checked for late dependencies. A final change record would capture the replacement, last known configuration, disposal or reuse decision, and the date after which historical data can be archived or removed.

How do NetBox users model this today? Do statuses, tags, custom fields, event rules, change logging, and branching provide enough control, or do you keep decommission records in another system? What must be detached or preserved before a device is deleted rather than merely marked retired?