What is a Tunnel Virtual Interface (TVI)?

A Tunnel Virtual Interface (TVI) is a logical VOS interface, named with the tvi- prefix, that terminates a tunnel, such as IPsec, GRE, VXLAN, or an SD-WAN overlay path, rather than a physical port. Workflow templates auto-create and number them per tenant for control-plane tunnels to Controllers and data-plane tunnels between SD-WAN devices.

Key takeaways

• A TVI is a logical interface that terminates a tunnel, not a port.
• TVIs use the tvi- prefix and are numbered per tenant organization.
• Workflow templates auto-create TVIs and assign default IP addresses.
• TVI interfaces support /31 subnets and can be re-addressed to avoid clashes.
• Paired TVIs connect microsegmentation zones to virtual routers.

On this page: Why it matters · How it works · Types · TVI & Versa · FAQ

Why is a TVI important?

Every SD-WAN overlay and every site-to-site VPN needs somewhere to route traffic to and from once a tunnel is up – an interface a routing table can point at, a firewall zone can bind to, and a static route or BGP session can reach. A TVI is that binding point on a VOS device: without it, a tunnel is just an encrypted path with no place in the device’s forwarding logic.

Because TVIs are logical rather than physical, one VOS device can terminate as many tunnels as it has policy and license headroom for, independent of its physical port count. That’s what lets a single branch device maintain resilient dual-Controller reachability, multiple site-to-site tunnels to different hubs, and microsegmentation paths to a SASE gateway, all at once – each tunnel gets its own TVI, its own address, and its own place in routing and zone policy.

What is a TVI?

A TVI represents one end of a tunnel on a VOS device. It behaves like any other Layer 3 interface for routing and policy purposes – it can belong to a virtual router, carry a static or BGP-learned route, sit in a security zone – but instead of a physical cable, its “link” is the tunnel itself: IPsec, GRE, VXLAN, or an SD-WAN data-plane path to another VOS device.

TVIs are named with a tvi-<slot>/<number> convention, for example tvi-0/101 or tvi-15/100. Numbering is scoped per tenant organization, and the specific slot used (tvi-0 versus tvi-15) and number ranges vary by deployment model – Workflow-template-generated interfaces reserve their own ranges so manually configured TVIs can avoid colliding with them.

Types of TVI addressing

Most TVIs get their IP address automatically. When Workflow templates configure IPsec for a branch device, Versa Director auto-assigns addresses from the 169.254.0.0/24 range and creates the paired TVI on both ends of the tunnel – no manual addressing step required for the common case.

Manual and re-addressed TVIs matter for two situations. First, because that default range sits in the tenant’s LAN VRF, it must stay unique across the organization; if two branches or two site-to-site tunnels land on the same VOS gateway with overlapping TVI addresses, the gateway rejects the configuration, and the TVIs must be re-addressed – Versa supports /31 subnets for this, keeping each tunnel’s address space minimal. Second, some designs pair two TVIs deliberately: one TVI connects to a LAN network, a second connects to the virtual router used to detect trusted networks, and both are added to the tenant’s LAN-VR and to client-facing zones together – the pattern used to route secure-access traffic through a captive portal for microsegmentation.

TVI & Versa

TVIs appear wherever a VOS device terminates a tunnel. In SD-WAN–SSE hub integration, Concerto-managed gateways (VCGs) get TVI numbering by default when site-to-site tunnels are configured, while the customer manages TVI numbering on the Director-side SSE hub – commonly in the tvi-15/<number> range, up to tvi-15/19999 – and EBGP peers directly over the TVI IP addresses to build active-standby or active-active traffic paths.

In Secure SD-WAN integration with Versa SSE, a branch device’s IPsec configuration to a VCG creates a tvi-0/<number> interface with an auto-assigned 169.254.0.x address; when that default range clashes with an existing address in the organization, the branch and its static routes must be re-addressed together. In EIP-based microsegmentation for SD-LAN, paired TVIs connect a client-facing LAN network and its trusted-network-detection virtual router to a SASE gateway, with a static route through the paired TVI completing the path.

Frequently asked questions

What does the tvi- prefix in an interface name mean?

It marks the interface as a tunnel virtual interface – a logical endpoint for a tunnel rather than a physical port. The number after the slash, such as tvi-0/101, distinguishes multiple TVIs on the same device and is scoped per tenant.

Does a TVI need manual IP addressing?

Not usually. Workflow templates auto-assign TVI addresses, typically from the 169.254.0.0/24 range, when they configure IPsec for a branch or gateway. Manual addressing or re-addressing is needed mainly to resolve conflicts when that default range is already in use elsewhere in the organization.

Why would two TVI interfaces need to be re-addressed?

TVI addresses must be unique within the tenant’s LAN VRF. If two branches, or two site-to-site tunnels landing on the same gateway, are both auto-assigned the same default range, the gateway rejects the duplicate configuration, so the conflicting TVIs must be moved to a different, unique address range.

What is a paired TVI interface?

A paired TVI setup uses two TVIs together: one connects a LAN network to a virtual router, the other connects that virtual router to a trusted-network-detection path. Both are added to the tenant’s LAN-VR and to the relevant zones, a pattern used for microsegmented secure-access routing.

Can a TVI carry BGP as well as static routes?

Yes. A TVI is a routable Layer 3 interface, so it can carry a static route to a next hop across the tunnel, or peer over EBGP using the TVI’s own IP address as the neighbor address – the model used for dynamic routing between SD-WAN gateways and SSE hubs.

More on TVIs

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about TVIs, these are worth looking at next.