Record WAN circuits and VPN tunnels

WAN circuits

1. On the Network view, open the link from a site to its internet or MPLS cloud.
2. On the WAN circuit tab, tick This link is a WAN circuit from a carrier.
3. Fill in the details you have, then click Save:
   • kind, carrier and circuit ID
   • bandwidth, monthly cost and contract end
   • support phone and a note

The link's label shows the carrier and bandwidth. The diagram assistant warns 90 days before a contract ends.

VPN tunnels

1. On the Network view, choose Draw → VPN tunnel at the top left of the canvas.
2. Drag from one device to the other. The tunnel's editor opens.
3. Set its type (IPsec, WireGuard, SSL or GRE), a name, which end brings it up (the IKE initiator, the SSL client, or the WireGuard peer that dials out), each end's public and tunnel addresses, and the networks it protects.
4. Fill in the type's own parameters underneath: for IPsec the IKE version, authentication, IDs and the IKE and ESP proposals; for WireGuard the public keys, ports and keepalive; for SSL the protocol, port, TLS key and cipher; for GRE the key, MTU and keepalive.

Tunnels draw as dashed violet lines. Addresses and IDs are encrypted at rest. Pre-shared keys and private keys are never stored -- use the note to say where they live.

The WAN report

Reports → WAN lists every circuit and tunnel in the network. Circuits come soonest-renewal first, with monthly and yearly cost. Download it with CSV.