diff --git a/xos/models.py b/xos/models.py
index 96fb71a..78342a6 100644
--- a/xos/models.py
+++ b/xos/models.py
@@ -19,8 +19,6 @@
 VCPE_KIND = "vCPE"
 CORD_SUBSCRIBER_KIND = "CordSubscriberRoot"
 
-CORD_USE_VTN = getattr(Config(), "networking_use_vtn", False)
-
 # -------------------------------------------
 # VCPE
 # -------------------------------------------
@@ -30,87 +28,34 @@
 
     URL_FILTER_KIND_CHOICES = ( (None, "None"), ("safebrowsing", "Safe Browsing"), ("answerx", "AnswerX") )
 
-    simple_attributes = ( ("bbs_api_hostname", None),
-                          ("bbs_api_port", None),
-                          ("bbs_server", None),
-                          ("backend_network_label", "hpc_client"),
-                          ("dns_servers", "8.8.8.8"),
-                          ("url_filter_kind", None),
-                          ("node_label", None),
-                          ("docker_image_name", "docker.io/xosproject/vsg"),
-                          ("docker_insecure_registry", False) )
-
-    def __init__(self, *args, **kwargs):
-        super(VSGService, self).__init__(*args, **kwargs)
+    url_filter_kind = StrippedCharField(max_length=30, choices=URL_FILTER_KIND_CHOICES, null=True, blank=True)
+    dns_servers = StrippedCharField(max_length=255, default="8.8.8.8")
+    node_label = StrippedCharField(max_length=30, null=True, blank=True)
+    docker_image_name = StrippedCharField(max_length=255, default="docker.io/xosproject/vsg")
+    docker_insecure_registry = models.BooleanField(default=False)
 
     class Meta:
         app_label = "vsg"
         verbose_name = "vSG Service"
-        proxy = True
-
-    def allocate_bbs_account(self):
-        vcpes = VSGTenant.get_tenant_objects().all()
-        bbs_accounts = [vcpe.bbs_account for vcpe in vcpes]
-
-        # There's a bit of a race here; some other user could be trying to
-        # allocate a bbs_account at the same time we are.
-
-        for i in range(2,21):
-             account_name = "bbs%02d@onlab.us" % i
-             if (account_name not in bbs_accounts):
-                 return account_name
-
-        raise XOSConfigurationError("We've run out of available broadbandshield accounts. Delete some vcpe and try again.")
-
-    @property
-    def bbs_slice(self):
-        bbs_slice_id=self.get_attribute("bbs_slice_id")
-        if not bbs_slice_id:
-            return None
-        bbs_slices=Slice.objects.filter(id=bbs_slice_id)
-        if not bbs_slices:
-            return None
-        return bbs_slices[0]
-
-    @bbs_slice.setter
-    def bbs_slice(self, value):
-        if value:
-            value = value.id
-        self.set_attribute("bbs_slice_id", value)
-
-VSGService.setup_simple_attributes()
 
 class VSGTenant(TenantWithContainer):
-    class Meta:
-        proxy = True
-
     KIND = VCPE_KIND
 
+    # it's not clear we still need this field...
+    last_ansible_hash = StrippedCharField(max_length=128, null=True, blank=True)
+
+    class Meta:
+        app_label = "vsg"
+
     sync_attributes = ("wan_container_ip", "wan_container_mac", "wan_container_netbits",
                        "wan_container_gateway_ip", "wan_container_gateway_mac",
                        "wan_vm_ip", "wan_vm_mac")
 
-    default_attributes = {"instance_id": None,
-                          "container_id": None,
-                          "users": [],
-                          "bbs_account": None,
-                          "last_ansible_hash": None,
-                          "wan_container_ip": None}
-
     def __init__(self, *args, **kwargs):
         super(VSGTenant, self).__init__(*args, **kwargs)
         self.cached_vrouter=None
 
     @property
-    def vbng(self):
-        # not supported
-        return None
-
-    @vbng.setter
-    def vbng(self, value):
-        raise XOSConfigurationError("vCPE.vBNG cannot be set this way -- create a new vBNG object and set it's subscriber_tenant instead")
-
-    @property
     def vrouter(self):
         vrouter = self.get_newest_subscribed_tenant(VRouterTenant)
         if not vrouter:
@@ -126,7 +71,7 @@
 
     @vrouter.setter
     def vrouter(self, value):
-        raise XOSConfigurationError("vCPE.vRouter cannot be set this way -- create a new vRuter object and set its subscriber_tenant instead")
+        raise XOSConfigurationError("VSGTenant.vrouter setter is not implemented")
 
     @property
     def volt(self):
@@ -138,21 +83,9 @@
             return None
         return volts[0]
 
-    @property
-    def bbs_account(self):
-        return self.get_attribute("bbs_account", self.default_attributes["bbs_account"])
-
-    @bbs_account.setter
-    def bbs_account(self, value):
-        return self.set_attribute("bbs_account", value)
-
-    @property
-    def last_ansible_hash(self):
-        return self.get_attribute("last_ansible_hash", self.default_attributes["last_ansible_hash"])
-
-    @last_ansible_hash.setter
-    def last_ansible_hash(self, value):
-        return self.set_attribute("last_ansible_hash", value)
+    @volt.setter
+    def volt(self, value):
+        raise XOSConfigurationError("VSGTenant.volt setter is not implemented")
 
     @property
     def ssh_command(self):
@@ -161,10 +94,6 @@
         else:
             return "no-instance"
 
-    @ssh_command.setter
-    def ssh_command(self, value):
-        pass
-
     def get_vrouter_field(self, name, default=None):
         if self.vrouter:
             return getattr(self.vrouter, name, default)
@@ -334,21 +263,6 @@
         # To-do: cleanup unused instances
         pass
 
-    def manage_bbs_account(self):
-        if self.deleted:
-            return
-
-        if self.volt and self.volt.subscriber and self.volt.subscriber.url_filter_enable:
-            if not self.bbs_account:
-                # make sure we use the proxied VSGService object, not the generic Service object
-                vcpe_service = VSGService.objects.get(id=self.provider_service.id)
-                self.bbs_account = vcpe_service.allocate_bbs_account()
-                super(VSGTenant, self).save()
-        else:
-            if self.bbs_account:
-                self.bbs_account = None
-                super(VSGTenant, self).save()
-
     def find_or_make_port(self, instance, network, **kwargs):
         port = Port.objects.filter(instance=instance, network=network)
         if port:
@@ -360,13 +274,10 @@
 
     def get_lan_network(self, instance):
         slice = self.provider_service.slices.all()[0]
-        if CORD_USE_VTN:
-            # there should only be one network private network, and its template should not be the management template
-            lan_networks = [x for x in slice.networks.all() if x.template.visibility=="private" and (not "management" in x.template.name)]
-            if len(lan_networks)>1:
-                raise XOSProgrammingError("The vSG slice should only have one non-management private network")
-        else:
-            lan_networks = [x for x in slice.networks.all() if "lan" in x.name]
+        # there should only be one network private network, and its template should not be the management template
+        lan_networks = [x for x in slice.networks.all() if x.template.visibility=="private" and (not "management" in x.template.name)]
+        if len(lan_networks)>1:
+            raise XOSProgrammingError("The vSG slice should only have one non-management private network")
         if not lan_networks:
             raise XOSProgrammingError("No lan_network")
         return lan_networks[0]
@@ -409,14 +320,13 @@
 
             # VTN-CORD needs a WAN address for the VM, so that the VM can
             # be configured.
-            if CORD_USE_VTN:
-                tags = Tag.select_by_content_object(instance).filter(name="vm_vrouter_tenant")
-                if not tags:
-                    vrouter = self.get_vrouter_service().get_tenant(address_pool_name="addresses_vsg", subscriber_service = self.provider_service)
-                    vrouter.set_attribute("tenant_for_instance_id", instance.id)
-                    vrouter.save()
-                    tag = Tag(service=self.provider_service, content_object=instance, name="vm_vrouter_tenant", value="%d" % vrouter.id)
-                    tag.save()
+            tags = Tag.select_by_content_object(instance).filter(name="vm_vrouter_tenant")
+            if not tags:
+                vrouter = self.get_vrouter_service().get_tenant(address_pool_name="addresses_vsg", subscriber_service = self.provider_service)
+                vrouter.set_attribute("tenant_for_instance_id", instance.id)
+                vrouter.save()
+                tag = Tag(service=self.provider_service, content_object=instance, name="vm_vrouter_tenant", value="%d" % vrouter.id)
+                tag.save()
 
     def save(self, *args, **kwargs):
         if not self.creator:
@@ -444,7 +354,6 @@
         vcpe = vcpe[0]
         vcpe.manage_container()
         vcpe.manage_vrouter()
-        vcpe.manage_bbs_account()
         vcpe.cleanup_orphans()
 
 
diff --git a/xos/synchronizer/steps/sync_vcpetenant.py b/xos/synchronizer/steps/sync_vcpetenant.py
index cb7ec15..e54b7e1 100644
--- a/xos/synchronizer/steps/sync_vcpetenant.py
+++ b/xos/synchronizer/steps/sync_vcpetenant.py
@@ -25,14 +25,10 @@
 parentdir = os.path.join(os.path.dirname(__file__),"..")
 sys.path.insert(0,parentdir)
 
-from broadbandshield import BBS
-
 logger = Logger(level=logging.INFO)
 
 ENABLE_QUICK_UPDATE=False
 
-CORD_USE_VTN = getattr(Config(), "networking_use_vtn", False)
-
 class SyncVSGTenant(SyncInstanceUsingAnsible):
     provides=[VSGTenant]
     observes=VSGTenant
@@ -66,7 +62,6 @@
         # object itself. In the case of vCPE, we need to know:
         #   1) the addresses of dnsdemux, to setup dnsmasq in the vCPE
         #   2) CDN prefixes, so we know what URLs to send to dnsdemux
-        #   3) BroadBandShield server addresses, for parental filtering
         #   4) vlan_ids, for setting up networking in the vCPE VM
 
         vcpe_service = self.get_vcpe_service(o)
@@ -118,25 +113,6 @@
 
         dnsdemux_ip = dnsdemux_ip or "none"
 
-        # Broadbandshield can either be set up internally, using vcpe_service.bbs_slice,
-        # or it can be setup externally using vcpe_service.bbs_server.
-
-        bbs_addrs = []
-        if vcpe_service.bbs_slice:
-            if vcpe_service.backend_network_label:
-                for bbs_instance in vcpe_service.bbs_slice.instances.all():
-                    for ns in bbs_instance.ports.all():
-                        if ns.ip and ns.network.labels and (vcpe_service.backend_network_label in ns.network.labels):
-                            bbs_addrs.append(ns.ip)
-            else:
-                logger.info("unsupported configuration -- bbs_slice is set, but backend_network_label is not",extra=o.tologdict())
-            if not bbs_addrs:
-                logger.info("failed to find any usable addresses on bbs_slice",extra=o.tologdict())
-        elif vcpe_service.bbs_server:
-            bbs_addrs.append(vcpe_service.bbs_server)
-        else:
-            logger.info("neither bbs_slice nor bbs_server is configured in the vCPE",extra=o.tologdict())
-
         s_tags = []
         c_tags = []
         if o.volt:
@@ -171,7 +147,6 @@
                 "docker_opts": " ".join(docker_opts),
                 "dnsdemux_ip": dnsdemux_ip,
                 "cdn_prefixes": cdn_prefixes,
-                "bbs_addrs": bbs_addrs,
                 "full_setup": full_setup,
                 "isolation": o.instance.isolation,
                 "safe_browsing_macs": safe_macs,
@@ -189,66 +164,8 @@
 
     def sync_fields(self, o, fields):
         # the super causes the playbook to be run
-
         super(SyncVSGTenant, self).sync_fields(o, fields)
 
-        # now do all of our broadbandshield stuff...
-
-        service = self.get_vcpe_service(o)
-        if not service:
-            # Ansible uses the service's keypair in order to SSH into the
-            # instance. It would be bad if the slice had no service.
-
-            raise Exception("Slice %s is not associated with a service" % instance.slice.name)
-
-        # Make sure the slice is configured properly
-        if (service != o.instance.slice.service):
-            raise Exception("Slice %s is associated with some service that is not %s" % (str(instance.slice), str(service)))
-
-        # only enable filtering if we have a subscriber object (see below)
-        url_filter_enable = False
-
-        # for attributes that come from CordSubscriberRoot
-        if o.volt and o.volt.subscriber:
-            url_filter_enable = o.volt.subscriber.url_filter_enable
-            url_filter_level = o.volt.subscriber.url_filter_level
-            url_filter_users = o.volt.subscriber.devices
-
-        if service.url_filter_kind == "broadbandshield":
-            # disable url_filter if there are no bbs_addrs
-            if url_filter_enable and (not fields.get("bbs_addrs",[])):
-                logger.info("disabling url_filter because there are no bbs_addrs",extra=o.tologdict())
-                url_filter_enable = False
-
-            if url_filter_enable:
-                bbs_hostname = None
-                if service.bbs_api_hostname and service.bbs_api_port:
-                    bbs_hostname = service.bbs_api_hostname
-                else:
-                    # TODO: extract from slice
-                    bbs_hostname = "cordcompute01.onlab.us"
-
-                if service.bbs_api_port:
-                    bbs_port = service.bbs_api_port
-                else:
-                    bbs_port = 8018
-
-                if not bbs_hostname:
-                    logger.info("broadbandshield is not configured",extra=o.tologdict())
-                else:
-                    tStart = time.time()
-                    bbs = BBS(o.bbs_account, "123", bbs_hostname, bbs_port)
-                    bbs.sync(url_filter_level, url_filter_users)
-
-                    if o.hpc_client_ip:
-                        logger.info("associate account %s with ip %s" % (o.bbs_account, o.hpc_client_ip),extra=o.tologdict())
-                        bbs.associate(o.hpc_client_ip)
-                    else:
-                        logger.info("no hpc_client_ip to associate",extra=o.tologdict())
-
-                    logger.info("bbs update time %d" % int(time.time()-tStart),extra=o.tologdict())
-
-
     def run_playbook(self, o, fields):
         ansible_hash = hashlib.md5(repr(sorted(fields.items()))).hexdigest()
         quick_update = (o.last_ansible_hash == ansible_hash)
@@ -257,12 +174,10 @@
             logger.info("quick_update triggered; skipping ansible recipe",extra=o.tologdict())
         else:
             if o.instance.isolation in ["container", "container_vm"]:
+                raise Exception("probably not implemented")
                 super(SyncVSGTenant, self).run_playbook(o, fields, "sync_vcpetenant_new.yaml")
             else:
-                if CORD_USE_VTN:
-                    super(SyncVSGTenant, self).run_playbook(o, fields, template_name="sync_vcpetenant_vtn.yaml")
-                else:
-                    super(SyncVSGTenant, self).run_playbook(o, fields)
+                super(SyncVSGTenant, self).run_playbook(o, fields, template_name="sync_vcpetenant_vtn.yaml")
 
         o.last_ansible_hash = ansible_hash
 
diff --git a/xos/synchronizer/steps/sync_vcpetenant_vtn.yaml b/xos/synchronizer/steps/sync_vcpetenant_vtn.yaml
index b604741..2a63234 100644
--- a/xos/synchronizer/steps/sync_vcpetenant_vtn.yaml
+++ b/xos/synchronizer/steps/sync_vcpetenant_vtn.yaml
@@ -29,10 +29,6 @@
         {% for prefix in cdn_prefixes %}
         - {{ prefix }}
         {% endfor %}
-      bbs_addrs:
-        {% for bbs_addr in bbs_addrs %}
-        - {{ bbs_addr }}
-        {% endfor %}
       dns_servers:
         {% for dns_server in dns_servers %}
         - {{ dns_server }}
diff --git a/xos/tosca/resources/vcpeservice.py b/xos/tosca/resources/vcpeservice.py
index 1d8754c..4c177aa 100644
--- a/xos/tosca/resources/vcpeservice.py
+++ b/xos/tosca/resources/vcpeservice.py
@@ -5,6 +5,6 @@
     provides = "tosca.nodes.VSGService"
     xos_model = VSGService
     copyin_props = ["view_url", "icon_url", "enabled", "published", "public_key",
-                    "private_key_fn", "versionNumber", "backend_network_label",
+                    "private_key_fn", "versionNumber",
                     "dns_servers", "node_label", "docker_image_name", "docker_insecure_registry"]