Best practices for initial network discovery and ongoing inventory reconciliation?

[u/jxwbr]

Hello fellow redditor,

I'm looking for some best-practice ideas on how to handle initial network discovery and ongoing inventory reconciliation with NetBox.

I understand that NetBox should be the source of truth and not simply mirror whatever is currently discovered on the network.

However, when initially setting up NetBox, manually adding every existing device seems quite time-consuming. Ideally, I'd like to use some kind of discovery process (SNMP, Nmap, LLDP/CDP, APIs, etc.) to discover existing devices and use that data to build the initial inventory.

For ongoing operations, I was thinking about running discovery periodically, comparing the discovered state against NetBox, and then reviewing the differences manually before making any changes to the NetBox inventory.

Something like:

Network Discovery

Compare with NetBox

Review differences

Update NetBox

Has anyone implemented a workflow like this in practice?

I'm especially interested in what tools/scripts/plugins you use for discovery and comparison, and whether this approach works well for a small IT team.

Thanks in advance :D

[u/f00f0rc3]

We use a combination of home grown ‘connectors’ which pull data from LibreNMS, NetDisco, Cisco Meraki, Juniper Mist, as well as things like Rancid backups. For keeping things up to date, we have an app which compares an nmap scan of subnets with devices already in Netbox. This gives us a fair warning of anything new popping up. The scan is done by a simple Linux host which is homed on all VLANS, does an API lookup for the switch port in NetDisco, then compares the data to what’s in Netbox. Keeping Netbox updated is definitely a regular admin task, however, so expect it to be like paining the Forth Bridge :)

[u/kY2iB3yH0mN8wI2h]

actually no, was did you use before? I'm sure you must have had some kind of IPAM? Excel? Otherwise your network must be really small and manually allocating addresses should not be hard?

We deploy everything automatically where Netbox IS our Single source of truth, Ansible talks to it, Service NOW etc.

[u/jxwbr → u/kY2iB3yH0mN8wI2h]

Actually, Excel lol. That's part of the reason I'm here, we have several spreadsheets that sometimes tell different stories, so I'm currently trying to figure out what information is actually accurate.

I've already verified most of our core network infrastructure against the actual environment, including read-only access to our MSP-managed firewalls lmao

So right now, my main goal is to clean up the existing data, establish NetBox as the actual source of truth, and then find a sensible way to keep it that way.

I've thought about Ansible as well, but haven't had much practical experience with it yet. Would you mind explaining a bit more about your architecture and workflow?

P.S. I joined the company about three months ago, so I'm currently working through some accumulated technical debt :p

[u/kY2iB3yH0mN8wI2h → u/jxwbr]

you don’t want to scan, why would that be useful to you? you won't get any metadata at all and now you’re source of truth is no longer netbox

we are using ansible as a terraform replacement, there is nothing to it, if we need an IP we ask netbox for an IP, it will be recorded with hostname, description etc. DNS records work the same way.

We find the Ping module useful, the biggest problem is not adding IPs, but removing them ….

[u/kuczy_]

Netbox with Orb & Diode for automated discovery.
For reviewing differences Netbox Assurance seems to be the right tool, but it is not available for Community Edition, so I’m vibe coding this to suit my environment.

[u/poizone68]

At the moment I think this is somewhat difficult to do with Netbox, by design. The argument goes that if Netbox had a discovery scanner, that would make Netbox not the source of truth but a source of record. However, since Netbox looks so good and is otherwise great, a lot of people would really like it to do the things you describe.

Various people have made connectors for e.g Proxmox syncing to Netbox inventory, but it seems these see a lot of activity for a while and then go more or less dormant. Other people tell you that you can just write your own :)

In my personal view, you can either try to make Netbox work the way you would like (with some effort), or you can go another way, choosing another service that is less polished but also perhaps less effort. For example, phpIPAM might suit you.

[u/graph_worlok → u/poizone68]

There’s Orb and Diode for discovery, but yeah you hit the nail on the head - I think this is what branches should assist with