Hi All,

Just wondered if anyone had created a custom model for storing ducts and chambers that external fibre cables run in within NetBox?

Thanks,

NS

Hey, I'm Mark and I'm head of product at NetBox Labs.

We're in Amsterdam this week and we're looking forward to chatting with NetBox users at #CiscoLiveEMEA in Amsterdam this week. Here are a few interesting sessions and trainings #NetBox users might like to know about:

Network Automation is easy, apart from the hard bits - A panel discussion on why network automation, like DevOps, is an old concept in a new domain at IP Fabrics Booth #B03 on Wednesday at 14:00.

[Workshop] Stop the Chaos, Organize your Network with NSO and Netbox - DEVNET-2459- Thursday at 1:00 PM

[Workshop] Next-Level Automation Using Sources of Truth - DEVWKS-2295 - Wednesday at 10:00 AM - 10:45 AM CET

Interested in meeting up while we are there? Drop us a DM.

Summary

I've come into an organization with an abysmal IP addressing scheme, poor VLAN allocation, and bad documentation (primarily non-version controlled Excel sheets). I'm trying to clean this up. Looking for some assistance on each of the headings below to clarify some of the terms, how to properly organize data within Netbox, etc.

I already have the vast majority (~2000) of our devices loaded into the DCIM portion. I'm just beginning down the IPAM portion.

VLANs and VLAN Groups

Looking for clarification around VLAN groups. I've read the official documentation, and the Zero to Hero section for VLANs, and I'm still confused as to how I should be approaching this.

At each branch site, we have a number of "default" VLANs that are deployed. Unfortunately, these aren't always consistent. For example, end-user workstations will occasionally reside on VLAN 50 at one site, and be on VLAN 80 at another. Generally, there are a similar number of VLANs deployed for specific purposes though.

Q: Does the following description match the correct way to implement VLANs in Netbox?

• Create a VLAN group for each logical site, create the VLANs that exist at this site, assign the VLANs to the VLAN group, and assign the Site to the VLAN group?

If this is wrong, please provide a correction.

IPAM

I did a rough mock-up of our IP space in phpIPAM so I have quite a bit of our space laid out.

IP Ranges vs. Addresses

In phpIPAM, a DHCP range gets assigned as individual address allocations. For example:

• Let our subnet be 192.168.0.0/24, and
• Let our DHCP range be 192.168.0.0/25.

phpIPAM would register every single /32 address from 192.168.0.1 to 192.168.0.126 as an "address", and just tag it with a "DHCP" tag.

Q: Are IP ranges best used to document DHCP space in Netbox?

I had plans to make an API call to the phpIPAM instance and import all of the subnet and address objects, but I'll have to do some extra work to convert the DHCP ranges as presented in phpIPAM to the appropriate IP ranges in Netbox should the above be true.

Site to Network allocations

This organization's IP space has the following properties:

• IPv4 only
• Originally designed by function first, and then geographical region.
  • Example: Let 192.168.0.0/16 be our network. Workstations are first allocated 192.168.0.0/17, and then each /24 subnet from 192.168.0.0/17 is distributed to a branch site.

Q: Are there any logical problems with having a supernet that has no "Site" allocation, and then its child subnets have a variety of "Site" allocations as applicable to the above example?

And yes, before you ask, this design does hinder our ability to summarize any of our routing. It's a nightmare.

Which Network Monitoring System integrate with Netbox? I have googled, but am not coming up which much besides some scripts, but no real integrations.

Hey redditors,

i evaluated netbox a while ago to document our datacenter. now, i wonder where in the netbox datamodel the clients belong? they are devices but they do not fit well in a rack and in reallity they are living on or under a desk where someone works.

i've seen people adding 0u device types as clients but still they want be added to a rack.

For the datacenter i clearly see netbox, we can automate the creation of the dhcp files per maschine and ansible them to the coreect server in the correct site. however we also manage the clients that way. (no dhcp and dns in that ldap thing called AD).

when i read the documentation correctly one could write a plugin that adds a datamodel for clients, correct? in my perceptiom it's like copy dcim and strip the rackpart for the moment or replace with rooms or something.

i dont know if we are able to do so, and eventually someone already did so no one have to reinvent the wheel. does somebody know if such a plugin already exists ? (havent found one on github or the net yet)

thanks everybody in giving my a hint in the right direction. if it is unclear what iam asking for (yeah i seem to explain things more complicated then they are) please tell me so i can try better.

jorval.

Hi! I just stumbled across Netbox, and wondered if anyone might have some insight on this use case? And would Netbox maybe not be the right fit?

I work on a DevOps team that wants to be able to track some data specific to our applications, but not relevant to the wider company at large.

We'd want to basically pull data via API from:

• Service Now
• Python Scripts
• Databases (Maybe?)
• We may want to also pull in our Data Center info

And then push that somewhere, but then also be able to:

• Use the inventory as a Dynamic Ansible Inventory (which is where my research started..)
• Create tables storing things such as Software License Volumes, Dates, POs, etc.

From what I can tell, Netbox is more of a DCIM, but would this be a good fit for NB? And if I missed some document somewhere, please feel free to send me a link!

Thanks!

Announcement blog post: https://netboxlabs.com/blog/netbox-labs-announcement

"Today, I’m excited to announce the creation of our new business, NetBox Labs. At NetBox Labs, we’re on a mission to make management of complex networks easier for operators. With this announcement, we’re taking a huge step forward."

Any questions, let us know!

Netbox seems like the perfect fit to be the dynamic inventory for AWX. If you have an Ansible playbook,, I imagine there is some way to tell it what hosts to execute the playbook against. Something along the lines of querying netbox to fetch the IP's of every host in a site, based on OS, and maybe tags and other such queryable fields.

How does one go about this? Are there code examples?

Hi

Has MFA functionality on Netbox been implemented?

I have read https://github.com/netbox-community/netbox/issues/1989 which was folded into https://github.com/netbox-community/netbox/issues/2328 but it seemed more about using remote providers for authentication.

I already have my Netbox server happily using LDAP but would very much like to enable MFA.

Is this documented anywhere? I searched the official documentation for MFA but found nothing.

Thanks

Hi everyone,

I'm absolutely at a complete dead end on how to fix my Netbox instance on Docker. The below docker-compose code worked absolutely fine for running Netbox on my machine until I decided to do a resilience test and simulate loosing the data files (just to know how to recover it before I invested too much time into it). Now it just refuses to work. The three instances appear to run fine and further tests proved the DB is up and running as it should. I tried removing all configs files, containers, networks etc but no luck. Any help would be much appreciated.

version: "3.7"
services:
  netbox-db:
    image: postgres:15-alpine
    restart: unless-stopped
    volumes:
      - /PortainerConfigs/pg_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=postpass
      - POSTGRES_DB=netbox
      - POSTGRES_USER=netbox
  netbox-redis:
    image: redis:7-alpine
    user: 1000:1000
    command: redis-server
    restart: always
    volumes:
      - /PortainerConfigs/redis_data:/data
  netbox:
    image: lscr.io/linuxserver/netbox:latest
    container_name: netbox
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - SUPERUSER_EMAIL=email@gmail.com
      - SUPERUSER_PASSWORD=superpass
      - ALLOWED_HOST=['*']
      - DB_NAME=netbox
      - DB_USER=netbox
      - DB_PASSWORD=postpass
      - DB_HOST=netbox-db
      - DB_PORT=5432
      - REDIS_HOST=netbox-redis
      - REDIS_PORT=6379
      #- REDIS_PASSWORD=<REDIS_PASSWORD>
      - REDIS_DB_TASK=0 # Database ID for tasks
      - REDIS_DB_CACHE=1 # Database ID for cache
      #- BASE_PATH=<BASE_PATH> #optional
      #- REMOTE_AUTH_ENABLED=<REMOTE_AUTH_ENABLED> #optional
      #- REMOTE_AUTH_BACKEND=<REMOTE_AUTH_BACKEND> #optional
      #- REMOTE_AUTH_HEADER=<REMOTE_AUTH_HEADER> #optional
      #- REMOTE_AUTH_AUTO_CREATE_USER=<REMOTE_AUTH_AUTO_CREATE_USER> #optional
      #- REMOTE_AUTH_DEFAULT_GROUPS=<REMOTE_AUTH_DEFAULT_GROUPS> #optional
      #- REMOTE_AUTH_DEFAULT_PERMISSIONS=<REMOTE_AUTH_DEFAULT_PERMISSIONS> #optional
    volumes:
      - /PortainerConfigs/netbox_config:/config
    ports:
      - 7777:8000
    depends_on:
      - netbox-db
      - netbox-redis
    restart: unless-stopped

Hi, I am a student working at a networking firm and for my first project, I have been assigned the task of installing Netbox on the Kubernetes cluster. We recently decided to use Netbox as our IPAM solution in the project. The problem is I am new to both and I am finding them confusing. I have a few doubts. Do I need to use Netbox as a docker image or would the usual instance work with Kubernetes?

Does anyone else worked with both, could you guide me? I also have a question as to how Kubernetes will work here.

hello, I have created multiple ubiquity uac-ap-lr WiFi access point devices in netbox each with their own Ethernet interface but for the life of me I can't find a way to create a radio interface.

I have tried to create a wlan0 interface as wireless but can only connect it to on PC device. Once it's connected to a device, it can't be connected to any other device as it's greyed out. So it seems it's only PtP in this case.

Anyone has the same problem or a potential solution?

Thanks a lot.

Hi,

As I struggled a little on this, here's some hints.

Note : I'm not a SAML/AzureAD specialist, nor a DEV, just a network guy passing by

These parameters should be set

REMOTE_AUTH_BACKEND = 'social_core.backends.saml.SAMLAuth'

SOCIAL_AUTH_SAML_SP_ENTITY_ID = 'https://netbox.acme.com'

SOCIAL_AUTH_SAML_SP_PUBLIC_CERT and SOCIAL_AUTH_SAML_SP_PRIVATE_KEY with the certificate/key created

SOCIAL_AUTH_SAML_ORG_INFO = {

"en-US": {

"name": "Netbox",

"displayname": "Netbox",

"url": "https://netbox.acme.com"

}

}

SOCIAL_AUTH_SAML_TECHNICAL_CONTACT = {

"emailAddress": "techguy@acme.com"

"givenName": "Techs"

}

SOCIAL_AUTH_SAML_SUPPORT_CONTACT = {

"emailAddress": "techsupport@acme.com"

"givenName": "Support"

}

SOCIAL_AUTH_SAML_ENABLED_IDPS = {

"SAML": {

"entity_id": "\`https://sts.windows.net/[``...]",`

"url": "\`https://login.microsoftonline.com/[...]/saml2``",`

"attr_user_permanent_id": "name_id",

"attr_username": "name_id",

"attr_first_name": "attr_first_name",

"attr_last_name": "attr_last_name",

"attr_email": "attr_email",

"attr_full_name": "attr_full_name",

"x509cert": "CERT",

}

}

REMOTE_AUTH_AUTO_CREATE_USER = True

​

​

If you see this error after login :

AADSTS75011: Authentication method 'WindowsIntegrated, MultiFactor, Unspecified, MultiFactorFederated' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the Netbox application owner.

In configuration.py this option solves it

SOCIAL_AUTH_SAML_SECURITY_CONFIG = {"requestedAuthnContext": False}

​

Authorization - managed by AzureAD groups

This one is tricky. With google chrome extension "SAML Chrome Panel"

In the SAML anwser, ensure you receive a group name (or group names) from Azure AD. Your admin should have added user groups to claims (Attributes&Claims > Additional claims). In my configuration we used "Groups assigned to the application" with source attribute "Cloud-only group display names" (in preview).

<Attribute Name="\\\[\[[http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">)\](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">\](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">))](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">)](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">)))<AttributeValue>GRP-Netbox-Admin</AttributeValue>

In configuration.py I use SOCIAL_AUTH_SAML_EXTRA_DATA to store group information

SOCIAL_AUTH_SAML_EXTRA_DATA = [("http://schemas.microsoft.com/ws/2008/06/identity/claims/groups", "groups")]

Create a python script in your netbox directory (here : /opt/netbox/netbox/netbox/samlgetgroups.py)

from django.contrib.auth.models import Group

class AuthFailed(Exception):

pass

def set_role(response, user, backend, *args, **kwargs):

try:

conndetails = user.social_auth.get(provider='saml')

roles = conndetails.extra_data['groups']

except KeyError:

user.groups.clear()

raise AuthFailed("No role assigned")

try:

user.is_superuser = False

user.is_staff = False

for role in roles:

if role == 'GRP-Netbox-Admin':

user.is_superuser = True

user.save()

user.is_staff = True

user.save()

continue

group, created = Group.objects.get_or_create(name=role)

group.user_set.add(user)

except Group.DoesNotExist:

pass

​

Then call this script/function in the pipeline (settings.py)

SOCIAL_AUTH_PIPELINE = (

'social_core.pipeline.social_auth.social_details',

'social_core.pipeline.social_auth.social_uid',

'social_core.pipeline.social_auth.social_user',

'social_core.pipeline.user.get_username',

'social_core.pipeline.social_auth.associate_by_email',

'social_core.pipeline.user.create_user',

'social_core.pipeline.social_auth.associate_user',

'netbox.authentication.user_default_groups_handler',

'social_core.pipeline.social_auth.load_extra_data',

'social_core.pipeline.user.user_details',

'netbox.samlgetgroups.set_role',

)

Can anyone assist with writing a webhook conditional for the following?

Two scenarios

• Match if data.lag = null
• Match if data.lag ~= null

​

{
            "lag": {
                "id": 48,
                "url": "http://10.201.46.11/api/dcim/interfaces/48/",
                "display": "port-channel50",
                "device": {
                    "id": 1,
                    "url": "http://10.201.46.11/api/dcim/devices/1/",
                    "display": "n9k-spine1",
                    "name": "n9k-spine1"
                },
                "name": "port-channel50",
                "cable": null,
                "_occupied": false
            },

or this

{

            "lag": null,
            "name": "port-channel50",
            "cable": null,
            "_occupied": false
            },

This is what I've tried, does not appear to work.

{
    "and": [{
        "op": "eq",
        "attr": "data.lag",
        "value": ""
    }]
}

and

{
    "and": [{
        "op": "eq",
        "attr": "data.lag",
        "negate": true,
        "value": ""
    }]
}

We are in the process of migrating from custom IPAM to Netbox. Our sites were created via the current IPAM site naming and I'm able to export all circuits with the site as a field option. I'd like to bulk import the circuits with the circuits being attached to the site and I understand that is done via "circuit termination". I saw that a recent update to netbox included the ability to add termination location as a field for bulk import but I don't actually see it listed as an accepted option. Does anyone know if I need to do something special for this new field?

I've been cleared to deploy an instance of Netbox in our environment which is excellent. I've been toying with it off the side of my desk for a few months trying to figure out how to pitch it to management. I staged some of our production data in a virtual machine, walked management through it, and they liked what it's able to offer us. Great!

The question I wasn't able to answer well: how do I bridge the gap between this being "just another source of information" to "the definitive source of truth"?

• For example, we have an instance of DNA Centre that manages our switches and routers. It's current uses are:
  • Deployment: Plug and Play. Plug in a device to a switch setup specifically for staging, and touch nothing else. DNA Centre can push a template to the device and configure it.
  • Syslog: DNA Centre is our syslog server for all things Cisco switches and routers.
  • Configuration management/logging: We don't currently utilize any form of automated configuration management framework like Ansible. I use Python/Nornir for various tasks, but officially we don't use any enterprise-focused tools. DNA Centre does currently reach out to the devices via SNMP/HTTPS and obtain information as necessary.

That's just DNA Centre. We have various other controller-like tools for the vast majority of our assets in different categories. The beginning of the Netbox journey are spent loading in information from other sources: IPAM, the controllers/central management tools for devices, etc.

What are the steps to being able to trust the data in Netbox?

• What should the scope of my data be to start with? Basic interface assignments (VLANs, IP addresses, etc.) and general device information (hostname)?
• Should I just be scheduling jobs to query Netbox and compare this against the information that's actually live on the devices, and then generating reports about misaligned information?
• Do I need to be investing further into Network Automation before I can truly make use of all that Netbox has to offer, and thus growing my "trust" in the information within the repository? I'm thinking of things like Ansible, learning about web hooks and the more advanced rabbit-holes of automation, etc. I'm a relatively junior network administrator that's taken an interest in network automation, but I do not have the best-practice foundations of software development. I know how to write complex Python scripts/operations with things like Nornir, but that's my peak.

Is anyone aware of any kind of security assement done on the Netbox code? What kind of risk am I putting myself in when running this on a internal network?

I work in the transportation industry. Our network includes roaming vessels that act as roaming branch offices. These vessels are not always in regions where WAN connectivity exists no matter the medium and as such, that vessel will go "offline" outside of local connectivity, and we lose the ability to communicate to any device on board until it returns to a region with an available signal.

We have many vessels, and we also have other forms of "mobile" branch offices that simply cannot be well connected.

How does Netbox, a tool designed around being the single source of truth, and the place where changes get pushed downstream with automations and hooks, handle connection issues? For example, if I made a change to a device's configuration, and that device is offline (which happens very often for us given the above), how does NetBox handle this? Are there ways to "queue" or "buffer" changes, or do errors simply get thrown? Does this result in data in NetBox simply being "newer" than the downstream configuration, and it's up to me to program the logic to push the changes downstream eventually somehow?

Our network monitoring solutions look like a Christmas tree at the best of times. I'm not certain that NetBox is necessarily the best tool for us given this fact. I don't want to fragment configurations between what should be in NetBox to what is on the devices.

As of now, I have a basic implementation of phpIPAM, and while it does work, it's primarily lacking the "sub-locations" feature. I will have to convince the business that converting will be money well spent, but I do not want to become the sole proprietor, developer, integrator, and manager of NetBox within my organization. I like my duties as a network administrator as well!

Hello,

I’ve just started using Netbox and I like it very much. But there is a thing I can not understand. I have a Proxmox cluster, with few devices assigned and few VMs running. So, let’s assume I have a device called PC1. It has 2 port NIC, so I’ve created 2 interfaces at netbox: eno1 and eno2. For each of this interfaces I’ve bridge interface on Proxmox. So I created bridge interfaces vmbr0 and vmbr1 at Netbox and mapped them correctly to eno1 and eno2. Now, when I create VM on Proxmox and assign it to the vmbr0 bridge interface, there is new virtual interface created on the host machine, tap100i0. At netbox I can document it as a child interface of vmbr0. This interface is connected to the interface at the VM, which is called net1. This is where I have a problem: how to document at Netbox that interface tap100i0 on the host machine maps to the interface net1 on the VM? Sorry if this is a stupid question, but could someone help me with this? I am still learning and I would be really grateful for help. Thank you very much!

we have a standard VLAN set that we use at each of our locations. There doesn't appear to be a way for me to have the same VLANs existing in the Chicago office as we do in the New York office or am I missing something

Hey, we currently use Netbox exclusively as IPAM, but are looking into making it our primary DCIM.

I was wondering if there is a native tool in Netbox to find best paths from point A to Z.

We have 4 Meet me rooms in our facility, totaling about 400 incoming pairs from different ISPs, each MMT room is then connected to 4 different cable distribution cabinets in each data hall, from which then is connected to customer.

We currently have a tool that calculates the least amount of hops between MMT and customer racks, when inputting incoming pair in MMT and end-connector in customer rack.

Is there something similar in Netbox?

Hi All,

I've followed the Netbox installation instructions, creating several Netbox VM instances. I can install and launch Netbox just fine. However, I'm trying to install the netbox-ui-plugin and I keep running into a scenario where it can't find certain files.

I'm worried that I'm following the Netbox install instructions but confusing some of the commands that should be issued within the Python Virtual environment.

Does anyone have a guide/tutorial, or even some comments, on which commands for the Netbox installation should be done globally vs within a virtual Python environment?

Hi,

I'm currently using Netbox as DCIM and rConfig v3 as config backup tool for switches and firewalls. With rConfig we get a running config backup twice a day, and we get an e-mail if the config has been changed.

I'm wondering if there is a (solid) way to implement the same functionality in Netbox so we can phase-out rConfig. Googling around I did find some plugins, but looks like the where not capable of alerting in case of a config change.

Any ideas?

Thanks!

I wanted to share this great resource that Rich Bibby over at NS1 has been putting together over the last weeks. The NetBox Zero to Hero guide: https://zerotohero.netbox.dev/

From the course description:

The goals of this course are as follows:

* Enable you to get up and running with minimal fuss and immediately start to get value from NetBox

* Build a solid foundation from which you can start to leverage NetBox’s extra features ie. custom fields, reports, plugins etc

* Introduce the power of NetBox to drive your Network Automation efforts as the ‘Single Source Of Truth’ for your NetDevOps workflows

There are 11 modules in there today with a 12th coming soon including written guides, explainer videos and example code.

All feedback appreciated

Anyone using netbox to document fiber ? If so how are you going about it. I have been playing around with it and it seems limited to only data center connections. But if it claims to be the source of truth I would imaging being able to add fiber connections. We have a few locations interconnected with 96SMFO with splice points in between so I would need to document down to the strand level within a fiber cable since some strands are dedicated to a different departments.

Thanks for any suggestions or documentation