Why Is a VTI Interface Automatically Created in Nebula Mode, and What Are the Configuration Options?

Zyxel_Stanley

Question:
Why does a VTI (Virtual Tunnel Interface) automatically appear when configuring a VPN in Nebula mode, and what can be done if the default VTI behavior causes APIPA traffic or interoperability issues?

Answer:
In Nebula mode, the system automatically creates a VTI (Virtual Tunnel Interface) whenever a VPN rule is configured. This is an intentional design mechanism to ensure proper VPN operation and consistent behavior across Nebula-managed devices. The auto-generated VTI cannot be removed or fully customized.

If the default VTI configuration results in APIPA-related issues or compatibility concerns, the following options may help:

Adjust the VTI IP address to a different subnet that avoids any overlap, such as using an address like 100.100.100.1/24.

If specific compliance requirements must be met (e.g., needing to use 10.255.169.0/24) and Nebula mode does not offer the necessary flexibility, consider switching the device to on-premise mode. In on-premise mode, policy-based VPN can be configured, giving you more control over IP allocation.