You should not use <tt>tun</tt> device in VE to migrate it. If you're using VPN in VE, just stop VPN, then produce the online migration and after that start the VPN. Of course, all current connections to VPN will be lost :(.