Skip to main content

Choosing a Device

Choose a type based on what the uncollected segment does, not what it's called. Find your situation in the table below to see which type to use.

Segment vs. synthetic device

The uncollected segment is the real network you can't collect: the internet, an MPLS core, a leased circuit. The synthetic device is the model you create to represent it. To choose a type, look at what the segment does, then create the device that matches.

Start Here​

Your situationUse
Sites reach each other over the public internetInternet node
Sites reach each other over a private carrier network (leased L3, hub-and-spoke)Intranet node
You connect to an external network you don't manage that traffic never routes throughAdjacent network
A provider L3 VPN / MPLS connects your sites, and you can't collect the PE/P routersL3 VPN
A provider extends one L2 broadcast domain across the WANL2 VPN
A single point-to-point L2 link runs through a providerWAN Circuit
Traffic is encrypted into an IPSEC tunnel and you need to model the tunnelEncryptor

If two rows seem to fit, the deciding questions below resolve it.

Deciding Questions​

Is the uncollected segment Layer 2 or Layer 3?​

  • Layer 2: the two ends share a broadcast domain or a single wire. Use L2 VPN (many endpoints, one broadcast domain) or WAN Circuit (exactly two endpoints, point-to-point).
  • Layer 3: the segment carries IP traffic. Use Internet node, Intranet node, or L3 VPN when it routes between your subnets, or an Adjacent network when it only terminates your traffic (a partner network you don't route through).

For an L3 segment: public or private addressing?​

  • Public: traffic transits the public internet. Use the Internet node, which routes only public addresses. Forward also localizes unassigned public addresses to it (see the note below).
  • Private (or mixed): a private inter-site network. Use an Intranet node, which routes both public and private addresses. Forward does not localize unassigned public addresses to an intranet node. An intranet node reaches only the subnets on its connections, whether you configure those subnets explicitly or Forward auto-discovers them from the gateway. A packet to an address outside that set stops at the intranet node instead of crossing it. Use this when the segment carries a known set of sites and you don't want it to absorb arbitrary public traffic the way the internet node does.
  • Provider L3 VPN / MPLS: a private L3 segment where the provider runs the core, so you can't collect the config and state of the PE and P routers that carry your traffic. Use an L3 VPN, a transit-only device that forwards between connections and drops any traffic it can't route to one, the way the provider's core does. It interconnects only connections in the same VRF; the VRF that separates the traffic lives on the provider's PE, not on your CE, so you assign each L3 VPN connection to a VRF on the synthetic device.
Where unassigned public addresses land

Every network shows an internet node on the Sources page, ready to edit, but it stays inert until it has connections. It becomes part of the model, appearing in topology and completing paths, only after Forward collects cloud devices (AWS, Azure, GCP, IBM Cloud, Alkira) and auto-connects it, or after you give it a connection yourself.

Once it's active, the internet node owns all unassigned public space. A public address that's already on your collected infrastructure, or on a connected site, localizes there. Only public addresses left over after that subtraction (all public space minus what's site-routed minus what you excluded) localize to the internet node, automatically. Traffic from those prefixes is sourced at the internet node, and traffic destined to them traverses toward and out of it.

An intranet node never does this. It models only the prefixes you configure or Forward discovers from its gateways' routing or BGP state, and it never absorbs unassigned public addresses. Adding an intranet node doesn't change where public addresses land. If no internet node is active either, an unmodeled public address localizes nowhere, and paths toward it stop at the network edge. For how to configure the internet node, see Reference → Internet node.

For general information on how Forward resolves an address to a location, see Path Analysis → IP Localization.

Internet node vs. Intranet node​

They're the closest pair. Both are L3 devices that connect sites. The differences:

Internet nodeIntranet node
Addresses routedPublic onlyPublic and private
Unassigned public subnetsLocated hereNot located here
How manyOne per network, edited in its drawerMultiple, you create them
NamingFixed name internetYou name it

Use both in the same snapshot when some sites connect over the internet and others over a private intranet. The two devices route independently, each over the sites you connect to it.

Intranet node vs. L3 VPN​

Both model an uncollectable private L3 inter-site network, both determine each connection's subnets the same way (entered manually or auto-discovered from the gateway — see Subnet Auto-Discovery), and both segregate connections into VRFs. Choose by what the uncollected segment is:

  • L3 VPN when a provider runs an MPLS/L3 VPN core between your CEs. Forward models it as a transit-only device: it forwards only between connections whose sites advertised the destination and drops anything else at ingress, the way a provider core carries your traffic without terminating it.
  • Intranet node when the segment is a private inter-site network of your own — a leased L3 service or an L3 hub-and-spoke — with the intranet node as the hub. It has a self interface that absorbs traffic it can't route to a connection, so an address reachable across the segment but not advertised by any connection localizes on the node rather than being dropped.

Either way you're modeling a segment you can't collect; the difference is whether that segment is a provider's opaque core (L3 VPN) or your own private routing between sites (intranet node).

VRFs on an L3 VPN or intranet node​

Each L3 VPN or intranet-node connection carries a VRF, and Forward interconnects connections only within the same VRF. A connection in VRF blue reaches other blue connections; it never reaches a connection in red. This lets one device model several independent VPNs at once: put each site's connection in its VRF, and the device keeps their routing tables separate the way the provider does.

Specifying the VRF is optional. Leave it blank and Forward assigns the connection to a single default VRF, so every connection you leave blank interconnects with the others (and with any connection you set explicitly to default). Set a VRF only when you need to keep VPNs apart on the same device; if every site is in one VPN, you can leave them all blank. A VRF name has the same character rules as a site name: word characters, dots, and hyphens only, with no spaces or commas.

Side-by-side comparison. On the left, an intranet node is a hub whose reachable subnets come from what you configure or Forward discovers per gateway. On the right, one L3 VPN device carries six CE connections split across two VRFs: three CEs in VRF blue interconnect with each other, three CEs in VRF red interconnect with each other, and the two groups stay separate even though they share the same L3 VPN device. Forward permits a route only to a subnet a CE advertised into that VRF.

Adjacent network vs. Intranet node or L3 VPN​

All three are L3 devices that attach to your sites and share the same connection fields and subnet auto-discovery. They differ in whether the segment carries your traffic onward:

  • Intranet node and L3 VPN are transit devices: traffic enters on one connection and can leave on another, because the segment routes between your sites. Use them for a private inter-site network of your own, or a provider core that carries your traffic between your CEs — see Intranet node vs. L3 VPN to pick between the two.
  • Adjacent network is a traffic sink: your traffic reaches it and returns from it, but it never forwards from one connection to another. Use it for a network you connect to but don't manage — a partner, a counterparty bank, a payment network — that terminates your traffic rather than carrying it between your sites.

To decide, ask what the far network does with a packet not addressed to it. If it forwards the packet onward, it's a transit device: model it as an intranet node or L3 VPN. If it only accepts traffic addressed to itself, it's a sink: model it as an adjacent network. List the subnets an adjacent network owns in its Owned subnets tab so it resolves as a path source or destination; see Reference → Adjacent network.

Two side-by-side panels. On the left, a transit device (an intranet node or L3 VPN) sits between Site A and Site B and forwards traffic all the way through, both arrows green, because it routes between its connections. On the right, Site A connects to an adjacent network that owns subnet 203.0.113.0/24 with a green two-way arrow, so traffic reaches the partner and returns; the arrow onward from the adjacent network into the opaque area beyond the partner is red and crossed out, because an adjacent network terminates traffic and never transits through to the far side.

L2 VPN vs. WAN Circuit​

Both are L2. Choose by endpoint count and topology:

  • WAN Circuit: exactly two endpoints, a point-to-point link. The connection count is fixed; you can't add or remove endpoints.
  • L2 VPN: two or more endpoints joined into a single broadcast domain (a distributed virtual bridge). Use it when the provider's L2 service behaves like one switch spanning multiple sites.

Each endpoint is one connection, carrying the collected interface it attaches to, an optional VLAN, and an optional connection name. Leave the VLAN blank for untagged; set it (1–4095) for the tag on that wire. The VLAN is locally significant to that link between the collected device and the synthetic device, not a network-wide tag, so a WAN Circuit that enters on VLAN 10 at one site and VLAN 20 at the other bridges the two, which is how you model provider VLAN translation. An L2 VPN does the same across all its members: each joins the shared broadcast domain on whatever VLAN you give its connection, and those VLANs need not match. Neither type routes, so there's no gateway, subnet, or discovery setting to configure.

An L2 VPN is a single broadcast domain: every member floods to every other member, and the per-endpoint VLAN only tags frames at each edge, it doesn't split the L2 VPN synthetic device into separate domains. To model several independent bridges, create a separate L2 VPN for each. (This differs from an L3 VPN, where one device can carry several VRFs.)

Side-by-side comparison. A WAN Circuit joins exactly two endpoints as a point-to-point link, each side able to use a different VLAN. An L2 VPN joins four endpoints into one shared broadcast domain that behaves like a single switch spanning the sites.

How You Add Each Type​

You add each type differently:

TypeHow to add it
Intranet nodeAdd synthetic device wizard, on the Sources → Synthetic nodes page.
Adjacent networkAdd synthetic device wizard.
L2 VPNAdd synthetic device wizard.
L3 VPNAdd synthetic device wizard.
WAN CircuitAdd synthetic device wizard.
Internet nodeIts own drawer on the Sources page, not the wizard. Every network has one; you can't delete it.
EncryptorREST API (Encryptors API).

Two types you don't add at all. Forward creates the Missing Peer automatically when a collected port that's an uplink to a synthetic device carries a VLAN or subinterface the device isn't configured to accept. Forward also derives synthetic optical devices from collected optical equipment; there's no wizard or API to create those yourself.

Once you've picked a type, see Configuring Connections for the field choices, or Automated Setup with NQE if you have many connections to add at once.