VTI Interfaces (Virtual Tunnel Interface) in VyOS

VTI (Virtual Tunnel Interface) is a virtual tunnel interface for route-based IPsec VPN. VTI provides a more flexible and scalable approach to IPsec compared to policy-based VPN.

Overview

What VTI Is

VTI creates a virtual point-to-point interface for an IPsec tunnel:

Site A (192.168.1.0/24)
    |
[VyOS A] ---- VTI (172.16.0.1/30) ---- IPsec Tunnel ---- VTI (172.16.0.2/30) ---- [VyOS B]
    |                                                                                    |
Site B (192.168.2.0/24)

Route-based vs Policy-based VPN

Policy-based VPN:

Traffic selectors determine which traffic is encrypted
Complex configuration for multiple subnets
Difficult to use with dynamic routing

Route-based VPN (VTI):

VTI interface behaves like a regular network interface
Routing determines what traffic goes through the VPN
Support for dynamic routing (OSPF, BGP)
Easier to scale

VTI Advantages

Dynamic routing - OSPF, BGP over IPsec
Flexibility - any traffic through the VTI is encrypted
Scalability - easy to add new subnets
QoS - you can apply a traffic-policy to the VTI
Monitoring - statistics like on a regular interface
Firewall - firewall rules on the VTI interface

When to Use VTI

Use VTI when:

You need dynamic routing over IPsec
There are multiple subnets behind the VPN
Flexible routing is required
Site-to-site VPN between VyOS routers

Use policy-based when:

Simple site-to-site (few subnets)
Legacy equipment does not support VTI
Precise control over traffic selectors is needed

Basic Configuration

Simple VTI Tunnel

Site A Configuration

# VTI interface
set interfaces vti vti0 address 172.16.0.1/30
set interfaces vti vti0 description 'IPsec to Site B'

# IPsec configuration
set vpn ipsec authentication psk site-b id '203.0.113.1'
set vpn ipsec authentication psk site-b id '203.0.113.2'
set vpn ipsec authentication psk site-b secret 'SuperSecretKey123!'

# IKE group
set vpn ipsec ike-group IKE-SiteB key-exchange 'ikev2'
set vpn ipsec ike-group IKE-SiteB lifetime '28800'
set vpn ipsec ike-group IKE-SiteB proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-SiteB proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-SiteB proposal 1 hash 'sha256'

# ESP group
set vpn ipsec esp-group ESP-SiteB lifetime '3600'
set vpn ipsec esp-group ESP-SiteB pfs 'dh-group14'
set vpn ipsec esp-group ESP-SiteB proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-SiteB proposal 1 hash 'sha256'

# Site-to-site peer with VTI binding
set vpn ipsec site-to-site peer site-b authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer site-b authentication pre-shared-secret 'site-b'
set vpn ipsec site-to-site peer site-b connection-type 'initiate'
set vpn ipsec site-to-site peer site-b ike-group 'IKE-SiteB'
set vpn ipsec site-to-site peer site-b default-esp-group 'ESP-SiteB'
set vpn ipsec site-to-site peer site-b local-address '203.0.113.1'
set vpn ipsec site-to-site peer site-b remote-address '203.0.113.2'

# Bind VTI to the peer
set vpn ipsec site-to-site peer site-b vti bind 'vti0'
set vpn ipsec site-to-site peer site-b vti esp-group 'ESP-SiteB'

# Disable automatic route installation
set vpn ipsec options disable-route-autoinstall

# Static route through VTI
set protocols static route 192.168.2.0/24 interface vti0

commit
save

Site B Configuration

# VTI interface (reversed addresses)
set interfaces vti vti0 address 172.16.0.2/30
set interfaces vti vti0 description 'IPsec to Site A'

# IPsec (same PSK, IKE, ESP groups)
set vpn ipsec authentication psk site-a id '203.0.113.2'
set vpn ipsec authentication psk site-a id '203.0.113.1'
set vpn ipsec authentication psk site-a secret 'SuperSecretKey123!'

set vpn ipsec ike-group IKE-SiteA key-exchange 'ikev2'
set vpn ipsec ike-group IKE-SiteA lifetime '28800'
set vpn ipsec ike-group IKE-SiteA proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-SiteA proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-SiteA proposal 1 hash 'sha256'

set vpn ipsec esp-group ESP-SiteA lifetime '3600'
set vpn ipsec esp-group ESP-SiteA pfs 'dh-group14'
set vpn ipsec esp-group ESP-SiteA proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-SiteA proposal 1 hash 'sha256'

# Peer configuration
set vpn ipsec site-to-site peer site-a authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer site-a authentication pre-shared-secret 'site-a'
set vpn ipsec site-to-site peer site-a connection-type 'respond'
set vpn ipsec site-to-site peer site-a ike-group 'IKE-SiteA'
set vpn ipsec site-to-site peer site-a default-esp-group 'ESP-SiteA'
set vpn ipsec site-to-site peer site-a local-address '203.0.113.2'
set vpn ipsec site-to-site peer site-a remote-address '203.0.113.1'

set vpn ipsec site-to-site peer site-a vti bind 'vti0'
set vpn ipsec site-to-site peer site-a vti esp-group 'ESP-SiteA'

set vpn ipsec options disable-route-autoinstall

# Route to Site A
set protocols static route 192.168.1.0/24 interface vti0

commit
save

Verifying the VTI Tunnel

# VTI interface status
show interfaces vti

# VTI details
show interfaces vti vti0

# IPsec SA (Security Associations)
show vpn ipsec sa

# Ping through the tunnel
ping 172.16.0.2 source-address 172.16.0.1
ping 192.168.2.10 source-address 192.168.1.1

# Traffic through the VTI
show interfaces vti vti0 statistics

Dynamic Routing over VTI

VTI with OSPF

Site A

# VTI interface
set interfaces vti vti0 address 172.16.0.1/30

# IPsec configuration (as above)
# ...

# OSPF over VTI
set protocols ospf area 0 network 172.16.0.0/30
set protocols ospf area 0 network 192.168.1.0/24

# Or bind to the interface
set protocols ospf interface vti0 area 0
set protocols ospf interface eth1 area 0

# OSPF authentication on the VTI
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'OSPFSecret!'

commit

Site B

set interfaces vti vti0 address 172.16.0.2/30

# OSPF
set protocols ospf area 0 network 172.16.0.0/30
set protocols ospf area 0 network 192.168.2.0/24

set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'OSPFSecret!'

commit

Verification:

# OSPF neighbors over VTI
show ip ospf neighbor

# OSPF routes
show ip route ospf

# OSPF interface details
show ip ospf interface vti0

VTI with BGP

Hub (AS 65000)

# VTI to Spoke 1
set interfaces vti vti1 address 172.16.1.1/30

# VTI to Spoke 2
set interfaces vti vti2 address 172.16.2.1/30

# BGP configuration
set protocols bgp system-as 65000
set protocols bgp parameters router-id 10.0.0.1

# BGP neighbor over VTI1
set protocols bgp neighbor 172.16.1.2 remote-as 65001
set protocols bgp neighbor 172.16.1.2 description 'Spoke 1'
set protocols bgp neighbor 172.16.1.2 address-family ipv4-unicast

# BGP neighbor over VTI2
set protocols bgp neighbor 172.16.2.2 remote-as 65002
set protocols bgp neighbor 172.16.2.2 description 'Spoke 2'
set protocols bgp neighbor 172.16.2.2 address-family ipv4-unicast

# Announce local networks
set protocols bgp address-family ipv4-unicast network 10.0.0.0/16

commit

Spoke 1 (AS 65001)

set interfaces vti vti1 address 172.16.1.2/30

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.1.0.1

set protocols bgp neighbor 172.16.1.1 remote-as 65000
set protocols bgp neighbor 172.16.1.1 description 'Hub'
set protocols bgp neighbor 172.16.1.1 address-family ipv4-unicast

set protocols bgp address-family ipv4-unicast network 10.1.0.0/16

commit

Verification:

# BGP summary
show ip bgp summary

# BGP neighbors
show ip bgp neighbors 172.16.1.2

# BGP routes
show ip bgp

Multiple VTI Tunnels

Hub-and-Spoke Topology

Hub with three Spokes:

# Hub configuration

# VTI to Spoke 1
set interfaces vti vti1 address 172.16.1.1/30
set interfaces vti vti1 description 'Tunnel to Spoke 1'

# VTI to Spoke 2
set interfaces vti vti2 address 172.16.2.1/30
set interfaces vti vti2 description 'Tunnel to Spoke 2'

# VTI to Spoke 3
set interfaces vti vti3 address 172.16.3.1/30
set interfaces vti vti3 description 'Tunnel to Spoke 3'

# IPsec peers
set vpn ipsec site-to-site peer spoke1 remote-address '203.0.113.11'
set vpn ipsec site-to-site peer spoke1 vti bind 'vti1'
set vpn ipsec site-to-site peer spoke1 vti esp-group 'ESP-DEFAULT'
# ... (IKE, ESP, auth configuration)

set vpn ipsec site-to-site peer spoke2 remote-address '203.0.113.12'
set vpn ipsec site-to-site peer spoke2 vti bind 'vti2'
set vpn ipsec site-to-site peer spoke2 vti esp-group 'ESP-DEFAULT'

set vpn ipsec site-to-site peer spoke3 remote-address '203.0.113.13'
set vpn ipsec site-to-site peer spoke3 vti bind 'vti3'
set vpn ipsec site-to-site peer spoke3 vti esp-group 'ESP-DEFAULT'

# OSPF to announce routes
set protocols ospf area 0 network 172.16.1.0/30
set protocols ospf area 0 network 172.16.2.0/30
set protocols ospf area 0 network 172.16.3.0/30
set protocols ospf area 0 network 10.0.0.0/16

commit

Full Mesh VTI

For full connectivity between all sites:

# Site A - VTI to Site B and Site C

# VTI to Site B
set interfaces vti vti10 address 172.16.10.1/30
set vpn ipsec site-to-site peer site-b vti bind 'vti10'

# VTI to Site C
set interfaces vti vti20 address 172.16.20.1/30
set vpn ipsec site-to-site peer site-c vti bind 'vti20'

# OSPF for automatic route exchange
set protocols ospf area 0 network 172.16.10.0/30
set protocols ospf area 0 network 172.16.20.0/30

commit

Advanced Configurations

VTI with BFD (Bidirectional Forwarding Detection)

BFD for fast detection of a tunnel failure:

# VTI interface
set interfaces vti vti0 address 172.16.0.1/30

# BFD on the VTI
set protocols bfd peer 172.16.0.2 interval receive 300
set protocols bfd peer 172.16.0.2 interval transmit 300
set protocols bfd peer 172.16.0.2 minimum-ttl 254

# OSPF with BFD
set protocols ospf interface vti0 bfd

# BGP with BFD
set protocols bgp neighbor 172.16.0.2 bfd

commit

BFD provides:

Fast failure detection (sub-second)
Automatic switchover to a backup tunnel
Better than OSPF/BGP hello timers

VTI with Policy Routing

Policy-based routing through VTI:

# Two VTI tunnels (primary and backup)
set interfaces vti vti0 address 172.16.0.1/30
set interfaces vti vti1 address 172.16.1.1/30

# Route map for critical traffic over primary
set policy route CRITICAL rule 10 destination address 192.168.10.0/24
set policy route CRITICAL rule 10 set interface vti0

# All other traffic over backup
set policy route CRITICAL rule 20 set interface vti1

# Apply to the inbound interface
set interfaces ethernet eth1 policy route CRITICAL

commit

VTI with QoS

Traffic shaping on the VTI:

# VTI interface
set interfaces vti vti0 address 172.16.0.1/30

# Traffic policy
set traffic-policy shaper VPN-LIMIT bandwidth 100mbit
set traffic-policy shaper VPN-LIMIT default bandwidth 80mbit
set traffic-policy shaper VPN-LIMIT default ceiling 100mbit
set traffic-policy shaper VPN-LIMIT default priority 5

# High priority for VoIP
set traffic-policy shaper VPN-LIMIT class 10 bandwidth 20mbit
set traffic-policy shaper VPN-LIMIT class 10 ceiling 30mbit
set traffic-policy shaper VPN-LIMIT class 10 priority 7
set traffic-policy shaper VPN-LIMIT class 10 match voip ip dscp ef

# Apply to the VTI
set interfaces vti vti0 traffic-policy out VPN-LIMIT

commit

VTI with Firewall

Firewall on the VTI to control traffic:

# Input firewall on the VTI
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 inbound-interface name vti0
set firewall ipv4 input filter rule 100 state established
set firewall ipv4 input filter rule 100 state related

# Forward through the VTI (allow only specific ports)
set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 inbound-interface name vti0
set firewall ipv4 forward filter rule 200 destination port 80,443
set firewall ipv4 forward filter rule 200 protocol tcp

# Log dropped packets
set firewall ipv4 forward filter rule 299 action drop
set firewall ipv4 forward filter rule 299 inbound-interface name vti0
set firewall ipv4 forward filter rule 299 log

commit

VTI with MTU Tuning

Correct MTU is critical for VTI:

# VTI MTU (IPsec overhead ~60-80 bytes)
set interfaces vti vti0 mtu 1400

# Or calculate: 1500 (Ethernet) - 20 (IP) - 8 (ESP) - 50 (IPsec overhead) = 1422
set interfaces vti vti0 mtu 1422

# MSS clamping for TCP
set firewall ipv4 forward filter rule 50 action accept
set firewall ipv4 forward filter rule 50 protocol tcp
set firewall ipv4 forward filter rule 50 tcp flags syn
set firewall ipv4 forward filter rule 50 tcp mss 1380

commit

Redundant VTI (Primary/Backup)

# Primary VTI over ISP1
set interfaces vti vti0 address 172.16.0.1/30
set vpn ipsec site-to-site peer site-b-primary remote-address '203.0.113.2'
set vpn ipsec site-to-site peer site-b-primary vti bind 'vti0'

# Backup VTI over ISP2
set interfaces vti vti1 address 172.16.1.1/30
set vpn ipsec site-to-site peer site-b-backup remote-address '198.51.100.2'
set vpn ipsec site-to-site peer site-b-backup vti bind 'vti1'

# Routing with metrics (primary distance 10, backup distance 20)
set protocols static route 192.168.2.0/24 interface vti0 distance 10
set protocols static route 192.168.2.0/24 interface vti1 distance 20

commit

Monitoring and Diagnostics

Checking VTI Status

# List of VTI interfaces
show interfaces vti

# Details of a specific VTI
show interfaces vti vti0

# Statistics
show interfaces vti vti0 statistics

# Brief information
show interfaces vti vti0 brief

Example output:

vti0: <POINTOPOINT,NOARP,UP,LOWER_UP>
    inet 172.16.0.1/30
    RX:  bytes    packets     errors    dropped
         1.2 GB   850120      0         0
    TX:  bytes    packets     errors    dropped
         890 MB   720340      0         0

Checking IPsec SA

# IPsec Security Associations
show vpn ipsec sa

# Detailed information
show vpn ipsec sa detail

# Specific peer
show vpn ipsec sa peer 203.0.113.2

Checking Connectivity

# Ping the VTI peer
ping 172.16.0.2

# Ping with a source
ping 192.168.2.10 source-address 192.168.1.1

# Traceroute
traceroute 192.168.2.10

# MTU discovery
ping 192.168.2.10 size 1400 do-not-fragment

Monitoring Routing

# All routes
show ip route

# Routes through the VTI
show ip route interface vti0

# OSPF routes
show ip route ospf

# BGP routes
show ip route bgp

Logs and Debugging

# IPsec logs
show log vpn ipsec

# Live monitoring
monitor log vpn

# Increase the logging level
set vpn ipsec logging level 2
commit

# View kernel messages
show log kernel | grep vti

tcpdump on the VTI

# Capture traffic on the VTI (already decrypted)
sudo tcpdump -i vti0 -n

# With verbose output
sudo tcpdump -i vti0 -n -v

# Save to a file
sudo tcpdump -i vti0 -w /tmp/vti0.pcap

# Capture on the physical interface (encrypted ESP)
sudo tcpdump -i eth0 esp -n

Troubleshooting

VTI Interface in DOWN State

Problem: The VTI interface shows DOWN.

Causes:

The IPsec tunnel is not established
Incorrect binding of the VTI to the peer
Errors in the IPsec configuration

Diagnostics:

# Check the IPsec SA
show vpn ipsec sa

# Check the VTI binding
show interfaces vti vti0

# Kernel messages
dmesg | grep vti

Solution:

# Restart IPsec
restart vpn ipsec

# Check the binding
show configuration vpn ipsec site-to-site peer site-b vti

# Make sure the peer is established
show vpn ipsec sa peer site-b

No Traffic Through the VTI

Problem: The VTI interface is UP, but there is no connectivity.

Causes:

Routes are missing
Firewall is blocking
NAT exclude rules

Diagnostics:

# Check the routes
show ip route

# Ping the VTI peer
ping 172.16.0.2

# Firewall
show firewall ipv4 forward filter

# NAT rules
show nat source rules

Solution:

# Add a route
set protocols static route 192.168.2.0/24 interface vti0

# NAT exclude for VPN traffic
set nat source rule 10 outbound-interface name eth0
set nat source rule 10 source address 192.168.1.0/24
set nat source rule 10 destination address 192.168.2.0/24
set nat source rule 10 exclude

commit

IPsec Tunnel Constantly Re-establishing

Problem: The IPsec SA keeps going down/up.

Causes:

MTU issues
Firewall is blocking keepalive
NAT traversal issues
Incompatible lifetime settings

Solution:

# Reduce the MTU
set interfaces vti vti0 mtu 1400

# DPD (Dead Peer Detection)
set vpn ipsec site-to-site peer site-b dpd action 'restart'
set vpn ipsec site-to-site peer site-b dpd interval 30
set vpn ipsec site-to-site peer site-b dpd timeout 120

# NAT traversal
set vpn ipsec options nat-traversal enable

commit

OSPF Not Working Over VTI

Problem: OSPF neighbors are not established.

Causes:

The VTI is in the DOWN state
Incorrect OSPF network configuration
MTU mismatch
Authentication mismatch

Diagnostics:

# OSPF neighbors
show ip ospf neighbor

# OSPF interface
show ip ospf interface vti0

# OSPF debug
monitor protocol ospf

Solution:

# Bind OSPF to the VTI
set protocols ospf interface vti0 area 0

# Network type
set protocols ospf interface vti0 network point-to-point

# MTU
set interfaces vti vti0 mtu 1400

commit

Asymmetric Routing Over VTI

Problem: Traffic goes through the VTI one way but not back.

Causes:

Routes are configured on only one side
Firewall is blocking return traffic
NAT issues

Solution:

# Make sure routes are configured on both sides
# Site A:
set protocols static route 192.168.2.0/24 interface vti0

# Site B:
set protocols static route 192.168.1.0/24 interface vti0

# Or use dynamic routing (OSPF/BGP)

Configuration Examples

Example 1: Simple Site-to-Site with Static Routes

Topology:

Site A: 192.168.1.0/24, WAN 203.0.113.1
Site B: 192.168.2.0/24, WAN 203.0.113.2
VTI: 172.16.0.0/30

Site A:

# VTI
set interfaces vti vti0 address 172.16.0.1/30
set interfaces vti vti0 description 'IPsec to Site B'

# IPsec
set vpn ipsec authentication psk site-b id '203.0.113.1'
set vpn ipsec authentication psk site-b id '203.0.113.2'
set vpn ipsec authentication psk site-b secret 'MyStrongSecret123!'

set vpn ipsec ike-group IKE-SITEB key-exchange ikev2
set vpn ipsec ike-group IKE-SITEB lifetime 28800
set vpn ipsec ike-group IKE-SITEB proposal 1 dh-group 14
set vpn ipsec ike-group IKE-SITEB proposal 1 encryption aes256
set vpn ipsec ike-group IKE-SITEB proposal 1 hash sha256

set vpn ipsec esp-group ESP-SITEB lifetime 3600
set vpn ipsec esp-group ESP-SITEB pfs dh-group14
set vpn ipsec esp-group ESP-SITEB proposal 1 encryption aes256
set vpn ipsec esp-group ESP-SITEB proposal 1 hash sha256

set vpn ipsec site-to-site peer site-b authentication mode pre-shared-secret
set vpn ipsec site-to-site peer site-b authentication pre-shared-secret site-b
set vpn ipsec site-to-site peer site-b connection-type initiate
set vpn ipsec site-to-site peer site-b ike-group IKE-SITEB
set vpn ipsec site-to-site peer site-b default-esp-group ESP-SITEB
set vpn ipsec site-to-site peer site-b local-address 203.0.113.1
set vpn ipsec site-to-site peer site-b remote-address 203.0.113.2
set vpn ipsec site-to-site peer site-b vti bind vti0
set vpn ipsec site-to-site peer site-b vti esp-group ESP-SITEB

set vpn ipsec options disable-route-autoinstall

# Static route
set protocols static route 192.168.2.0/24 interface vti0

commit
save

Example 2: Hub-and-Spoke with OSPF

Hub:

# VTI to three Spokes
set interfaces vti vti1 address 172.16.1.1/30
set interfaces vti vti2 address 172.16.2.1/30
set interfaces vti vti3 address 172.16.3.1/30

# IPsec peers (simplified)
set vpn ipsec site-to-site peer spoke1 remote-address 203.0.113.11
set vpn ipsec site-to-site peer spoke1 vti bind vti1
# ... (IKE, ESP, auth)

set vpn ipsec site-to-site peer spoke2 remote-address 203.0.113.12
set vpn ipsec site-to-site peer spoke2 vti bind vti2

set vpn ipsec site-to-site peer spoke3 remote-address 203.0.113.13
set vpn ipsec site-to-site peer spoke3 vti bind vti3

# OSPF
set protocols ospf parameters router-id 10.0.0.1
set protocols ospf area 0 network 172.16.1.0/30
set protocols ospf area 0 network 172.16.2.0/30
set protocols ospf area 0 network 172.16.3.0/30
set protocols ospf area 0 network 10.0.0.0/24

commit

Spoke 1:

set interfaces vti vti1 address 172.16.1.2/30

set vpn ipsec site-to-site peer hub remote-address 203.0.113.1
set vpn ipsec site-to-site peer hub vti bind vti1

set protocols ospf parameters router-id 10.1.0.1
set protocols ospf area 0 network 172.16.1.0/30
set protocols ospf area 0 network 10.1.0.0/24

commit

Example 3: Redundant VPN with Automatic Failover

# Primary VTI
set interfaces vti vti0 address 172.16.0.1/30
set interfaces vti vti0 description 'Primary VPN'

# Backup VTI
set interfaces vti vti1 address 172.16.1.1/30
set interfaces vti vti1 description 'Backup VPN'

# IPsec primary
set vpn ipsec site-to-site peer primary remote-address 203.0.113.2
set vpn ipsec site-to-site peer primary vti bind vti0
# ... (IKE, ESP, auth)

# IPsec backup
set vpn ipsec site-to-site peer backup remote-address 198.51.100.2
set vpn ipsec site-to-site peer backup vti bind vti1
# ... (IKE, ESP, auth)

# OSPF over both tunnels
set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 cost 10
set protocols ospf interface vti0 bfd

set protocols ospf interface vti1 area 0
set protocols ospf interface vti1 cost 20
set protocols ospf interface vti1 bfd

# BFD for fast failover
set protocols bfd peer 172.16.0.2 interval receive 300
set protocols bfd peer 172.16.0.2 interval transmit 300

set protocols bfd peer 172.16.1.2 interval receive 300
set protocols bfd peer 172.16.1.2 interval transmit 300

commit

Best Practices

Use VTI for route-based VPN:
- When you need dynamic routing
- Multiple subnets
- Flexible routing
MTU configuration:
- VTI MTU: 1400-1422
- Test the MTU: ping <ip> size 1400 do-not-fragment
- MSS clamping for TCP: 1380
Dynamic routing:
- OSPF for simple topologies
- BGP for complex routing policies
- BFD for fast failover
Security:
- Use strong encryption (AES-256, SHA-256)
- PFS (Perfect Forward Secrecy)
- Regular key rotation
Monitoring:
- Track VTI status
- IPsec SA lifetime
- Routing through the VTI
- Bandwidth utilization
Redundancy:
- Primary/Backup VTI tunnels
- BFD for fast failover
- OSPF/BGP for automatic rerouting
QoS:
- Traffic shaping on the VTI for critical applications
- Prioritization of VoIP/video traffic
Firewall:
- Control traffic through the VTI
- Logging for security audit
Descriptions:
- Add a description to VTI interfaces
- Document the purpose of each tunnel
Testing:
- Test failover
- Verify connectivity
- Monitor performance

Conclusion

VTI (Virtual Tunnel Interface) provides a flexible and scalable approach to building IPsec VPN. Key advantages:

Dynamic routing through the tunnel (OSPF, BGP)
Flexible routing without complex traffic selectors
Scalability for multiple subnets
QoS and firewall on the VTI interface
Monitoring like a regular interface

VTI is ideal for:

Enterprise site-to-site VPN
Hub-and-spoke topologies
Complex network architectures with dynamic routing
Redundant VPN with automatic failover

Use VTI when you need the flexibility and scalability of route-based VPN. For simple site-to-site scenarios, policy-based IPsec may be simpler.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Tunnel Interfaces (GRE, IPIP) in VyOS Loopback Interfaces in VyOS