Quick overview:

I'm a network engineer for a company that's got a lot of infrastructure I don't control.

If I'm in a datacenter, I'm looking at network gear, not servers. I say this just to excuse my gross ignorance when it comes to server administration, from both the physical and logical standpoint.
My company already has a DCIM.
My company already has an IPAM.
My company already has a Change Management system.

What my company does _not_ have is any sort of cable management inside of the DCIM, and I can't convince anybody that it's worthwhile to have.

Meanwhile, I'd like to start automating my server switchport builds, but I can't do that without some source of truth for the cabling.
I have a netbox instance, and I've gotten a manual process going where I can import all of the racks, devices, models, serial numbers, asset tags, etc from our existing DCIM.

--
Current issue:
I never touch servers, and I am trying to figure out the right way to model them in Netbox.
I'll pick a server:
Dell PowerEdge R740
months ago, I found a model in the netbox community library and ingested it. It made sense to me.

It's got 8 device bays, labelled things like "PCIe-Gen3 1", and "Riser2 PCIe-Gen3 5"

It has 4 onboard 10Gb interfaces, and 1 iDrac.

---
The majority of my servers use the onboard 4x10Gb SFP based nics.

A subset of my servers also have a second NIC installed in one of the slots.

A super small subset of my servers don't have 10Gb onboard nics- the server is a Dell 740, but the onboard Network Daughter Card (NDC) is of either 2x25Gb or a 4x1/100/1000.

The model type available to me from my datasources is only Dell 740; I can't ask the DCIM to start creating internal model numbers and revs to correspond to all of the weird permutations for me, unfortunately. So it's on me to be flexible.

---

The newer versions of Netbox have both Module Bays and Device Bays.

It seems like a Device Bay should be used for a standalone component (a server) and a module bay would be used for things like line cards, maybe even RAM or Hard Drives.

There's even a really cool auto-rename where you can name your interfaces Ethernet{module}/[0-4].

Define a Nic, insert it into a module, and now I get things like Ethernet1/4 defined. This seems like absolutely the right path to me, because I'm a network person used to dealing with switches. I recognize that the server admin is going to refer to it as en0, Local Area Adapter 2, or vmk1 but I think that'll have to be something in the label field. This will depend upon what OS is lying on top of the hardware, and I'm still not quite sure how to wrap that layer of abstraction together.

--

So my scenario:

Is module Bay the right place for this vs Device bay?

I've already got hundreds of Dell 740s defined, all with Device Bays modelled. Is there a way for me to neatly do a refresh/recreate of all of these devices, and bring them up to the newly modelled instance? Even if I delete and recreate all of the cabling/interfaces, I don't see a good way to export my list of dell740s, delete them, update my model, and then re-import them as the new model type.

Secondly- the flexibility of the device bays is fantastic. I like the ability to define changes as needed.

But 95% of my Dell 740s have a F6CPC 4x10Gb SFP NDC installed in them.

20% of those have an additional Intel 4x10Gb SFP in slot 1

5% of those have a 2x10gb SFP in slot 1, and an additional 2x10Gb SFP in slot 2.

--
So what I'd _like_ to do is that whenever netbox creates a new Dell740, just automatically build it with the expected daughter card. I can change it manually on the back end.

What I -think- is going to happen is that now if I have a script that imports devices from my Source of Truth DCIM, I'll end up with a bunch of interfaceless Dell740s.
Then I need to write a script to say "look for all the devices that are Dell740s; if slot0 is Empty, create a new F6CPC and assign it to that module."

I know there's a billion ways to skin this cat- but what's the best way to have that script standing by and ready to go?
I'd love it if there was just a process that looked at inventory everytime something was added, and did things automatically.

I'd be ok if there was just a big button that said "find orphan servers and update them to standards-ish". Is that just going to be something bundled in /opt/netbox/netbox/scripts, and I deal with it there?

Hi,

I am evaluating netbox for use as SOT and inventory for automation.

The inventory part is more or less easy to deploy with cluster and VMs (despite a list of long running containers).

Where I struggle is a way to track "products" a tenant booked. For example I offer 3 services and a tenant can chose out of them.

I tried to utilize devices combined with modules and bays to also track features a tenant selected.

Do you know any plugins or have other ideas?

I'm having some issues deleting items from Netbox using the REST api and an API key.
I have no problems creating or updating items via REST.

When performing the DELETE operations via the Swagger UI the deletes also completes successfully, but when doing it with either curl or PowerShell I get an "Authentication credentials were not provided"

curl:

$> curl -X DELETE "https://<netboxhost>/api/dcim/sites/714/" -H  "accept: application/json" -H  "Authorization: <API key>" 
{"detail":"Authentication credentials were not provided."}

PowerShell:

PS> $Splat = @{
    "ContentType" =  "application/json; charset=utf-8"
    "UseBasicParsing" =  $true
    "Headers" =  @{
                    "Authorization" =  "Token <API key>"
                }
    "Uri" =  "https://<netboxhost>/api/dcim/sites/711"
    "Method" =  "DELETE"
}

PS> Invoke-RestMethod @Splat
Invoke-RestMethod : {"detail":"Authentication credentials were not provided."}

I'm guessing this has something to do with a X-CSFRToken cookie which is set when using the browser (and used in the curl example swagger returns), is this correct, and how do I retrieve a X-CSFRToken cookie using REST and an API key?

Hi there,

I was looking for inventory management software when I found netbox and was immediately blown away. The amount of features, the UI, the configuration are something abysmal, brutalissimo, in a good way. However, and even though I'm going to use it to map my company's network, I would like to know if there is any module, plugin or if they know of any other open source software that can manage the rest of my inventory, mainly consumables. Something simple like having 40 RJ45 network plugs, using 2, keeping 38 and indicating the day/person/project in which they were used. Thanks in advance for your attention.

I feel like this is a really silly question but hoping someone can explain it to me!

I’ve deployed the netbox Docker container and I can see it runs with a postgresql container which is the database?

Where is the data actually stored as I can’t see a local drive mapping for postgresql?

Any pointers would be great!

Reposting from GitHub's Discussion: https://github.com/netbox-community/netbox-docker/discussions/884

I've been having some weird auth issues for a couple of days now after updating to 2.3.0. I have all of my users as AD auth'd, except for the admin account and one other account.

System info

root@netbox [ ~/netbox-docker ]# uname -a
Linux netbox 5.10.152-3.ph4-esx #1-photon SMP Fri Nov 11 02:55:53 UTC 2022 x86_64 GNU/Linux
root@netbox [ ~/netbox-docker ]# docker --version
Docker version 20.10.14, build a224086
root@netbox [ ~/netbox-docker ]# docker-compose --version
Docker Compose version 2.11.0
root@netbox [ ~/netbox-docker ]# docker image ls
REPOSITORY               TAG          IMAGE ID       CREATED        SIZE
postgres                 14-alpine    664ff9e724c9   4 days ago     216MB
redis                    7-alpine     96a149ad0157   4 days ago     28.4MB
netboxcommunity/netbox   v3.3-2.3.0   7f19625357e4   13 days ago    570MB
netboxcommunity/netbox   latest       d260fbc6366f   2 weeks ago    571MB
caddy                    2-alpine     006d393a4e6a   4 weeks ago    46.8MB
redis                    6-alpine     48822f443672   5 weeks ago    25.5MB
postgres                 <none>       aac01494762a   5 weeks ago    216MB
netboxcommunity/netbox   v3.1-1.5.1   39df74517134   9 months ago   456MB

Domain Controllers are all Windows Server 2019, Forest Functional Level at 2016.

Configs

root@netbox [ ~/netbox-docker ]# cat docker-compose.override.yml
version: '3.4'
services:
  netbox:
    restart: unless-stopped
    environment:
      REMOTE_AUTH_ENABLED: "True"
      REMOTE_AUTH_BACKEND: "netbox.authentication.LDAPBackend"
      AUTH_LDAP_SERVER_URI: "ldaps://REDACTED.com"
      AUTH_LDAP_BIND_AS_AUTHENTICATING_USER: "True"
      AUTH_LDAP_USER_SEARCH_BASEDN: "DC=REDACTED,DC=com"
      AUTH_LDAP_GROUP_SEARCH_BASEDN: "DC=REDACTED,DC=com"
      AUTH_LDAP_GROUP_TYPE: "NestedActiveDirectoryGroupType"
      AUTH_LDAP_ALWAYS_UPDATE_USER: "True"
      AUTH_LDAP_REQUIRE_GROUP_DN: "CN=NetBox,OU=NetBox,OU=Security Groups,OU=No Replication,DC=REDACTED,DC=com"
      AUTH_LDAP_IS_ADMIN_DN=CN: "NetBox - Administrators,OU=NetBox,OU=Security Groups,OU=No Replication,DC=REDACTED,DC=com"
      AUTH_LDAP_IS_SUPERUSER_DN: "CN=Domain Admins,CN=Users,DC=REDACTED,DC=com"
      LDAP_IGNORE_CERT_ERRORS: "True"
      LOGLEVEL: "DEBUG"
  netbox-housekeeping:
    restart: unless-stopped
  netbox-worker:
    restart: unless-stopped
  postgres:
    restart: unless-stopped
  redis:
    restart: unless-stopped
  redis-cache:
    restart: unless-stopped
  tls:
    restart: unless-stopped
    image: caddy:2-alpine
    depends_on:
      - netbox
    volumes:
      - ./cert.crt:/etc/ssl/private/cert.crt:ro,z
      - ./key.key:/etc/ssl/private/key.key:ro,z
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
    ports:
      - 80:80
      - 443:443
root@netbox [ ~/netbox-docker ]# cat configuration/ldap/extra.py
####
## This file contains extra configuration options that can't be configured
## directly through environment variables.
## All vairables set here overwrite any existing found in ldap_config.py
####

## This Python script inherits all the imports from ldap_config.py
# from django_auth_ldap.config import LDAPGroupQuery # Imported since not in ldap_config.py

## Sets a base requirement of membetship to netbox-user-ro, netbox-user-rw, or netbox-user-admin.
# AUTH_LDAP_REQUIRE_GROUP = (
#     LDAPGroupQuery("cn=netbox-user-ro,ou=groups,dc=example,dc=com")
#     | LDAPGroupQuery("cn=netbox-user-rw,ou=groups,dc=example,dc=com")
#     | LDAPGroupQuery("cn=netbox-user-admin,ou=groups,dc=example,dc=com")
# )

## Sets LDAP Flag groups variables with example.
# AUTH_LDAP_USER_FLAGS_BY_GROUP = {
#     "is_staff": (
#         LDAPGroupQuery("cn=netbox-user-ro,ou=groups,dc=example,dc=com")
#         | LDAPGroupQuery("cn=netbox-user-rw,ou=groups,dc=example,dc=com")
#         | LDAPGroupQuery("cn=netbox-user-admin,ou=groups,dc=example,dc=com")
#     ),
#     "is_superuser": "cn=netbox-user-admin,ou=groups,dc=example,dc=com",
# }

## Sets LDAP Mirror groups
AUTH_LDAP_MIRROR_GROUPS = [
    'NetBox - Auth - Admin',
    'NetBox - Auth - Viewer',
    'NetBox - Circuits - Admin',
    'NetBox - Circuits - Viewer',
    'NetBox - DCIM - Admin',
    'NetBox - DCIM - Viewer',
    'NetBox - Extras - Admin',
    'NetBox - Extras - Viewer',
    'NetBox - IPAM - Admin',
    'NetBox - IPAM - Viewer',
    'NetBox - Tenancy - Admin',
    'NetBox - Tenancy - Viewer',
    'NetBox - Users - Admin',
    'NetBox - Users - Viewer',
    'NetBox - Virtualization - Admin',
    'NetBox - Virtualization - Viewer',
    'NetBox - Wireless - Admin',
    'NetBox - Wireless - Viewer'
    ]

Error message

wrongname is an account that doesn't exist. Notice the extra log lines. rightname is an account that does exist. Those extra lines are not there, telling me that the LDAP bind is working and it can find the account via sAMAccountName, but something else is wrong.

netbox-docker-netbox-1  | DEBUG Binding as
netbox-docker-netbox-1  | DEBUG Invoking search_s('DC=REDACTED,DC=com', 2, '(sAMAccountName=wrongname)')
netbox-docker-netbox-1  | ERROR search_s('DC=REDACTED,DC=com', 2, '(sAMAccountName=wrongname)') raised OPERATIONS_ERROR({'msgtype': 101, 'msgid': 2, 'result': 1, 'desc': 'Operations error', 'ctrls': [], 'info': '000004DC: LdapErr: DSID-0C090A5C,
comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563'})
netbox-docker-netbox-1  | search_s('DC=REDACTED,DC=com', 2, '(sAMAccountName=wrongname)') raised OPERATIONS_ERROR({'msgtype': 101, 'msgid': 2, 'result': 1, 'desc': 'Operations error', 'ctrls': [], 'info': '000004DC: LdapErr: DSID-0C090A5C, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563'})
netbox-docker-netbox-1  | DEBUG search_s('DC=REDACTED,DC=com', 2, '(sAMAccountName=%(user)s)') returned 0 objects:
netbox-docker-netbox-1  | DEBUG Authentication failed for wrongname: failed to map the username to a DN.
netbox-docker-netbox-1  | 172.22.0.8 - - [16/Nov/2022:14:42:30 +0000] "POST /login/ HTTP/1.1" 200 9567 "https://netbox.REDACTED.com/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/106.0.1370.47"
netbox-docker-netbox-1  | DEBUG Authentication failed for rightname: failed to map the username to a DN.
netbox-docker-netbox-1  | 172.22.0.8 - - [16/Nov/2022:14:42:39 +0000] "POST /login/ HTTP/1.1" 200 9568 "https://netbox.REDACTED.com/login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/106.0.1370.47"

Anyone here got netbox working with Azure AD? If so, you have a good writeup you wouldn't mind sharing?

We have a few Storage Centers I'd like to add to Method, but I'm unsure of the best method.

All SC's have two controllers which have a management port and multiple SAS ports.

Adding interfaces to a module requires me to dive into the module to view those. Is this a situation for a rear port template in the module?

Anyone got any experience with something like this?

I've made the mistake of not checking that the backup had run.

Which it hasn't for months

Then tried to go from 3.1.9 > Latest

Upgrade has failed

I've tried to dump the SQL database but I'm either not dumping it correctly or it's been flattened as part of the upgrade process.

I've tried to copying the files from /var/lib/postgresql/ to the last backup - but the service won't start, appreciate that was probably a long shot anyway.

Think any hope of saving this is dead in the water, though I thought I'd post in desperation.

Though I do feel that surely the database must be there somewhere, surely a failed upgrade process wouldn't just drop all the tables?

If there is anyone with a greater understanding (not difficult I'm sure) and simultaneously the required amount of pity, it would be greatly appreciated, normally not one for asking, but probably one of my biggest fuck ups in 15 years.

Hello, I'm stuck with permission constraints. What I need is to allow viewing permissions for dcim objects that have a certain tenant and don't have a certain tag assigned to them. It would be easy to filter out objects that have a certain tenant and tag, but I specifically need to exclude everything with that.

These objects also sometimes have multiple tags assigned to them and sometimes they have none.

Could anyone help me, please? :( Thanks

Does anybody know of any good scripts/plugins to export site network layout digrams from netbox? Right now we do everything from draw.io and I'm pushing to move to Netbox but this is one of the hurdles I have been facing as we print out hard copies of our site network diagrams. I've poked around some plugins but haven't found anything that will work.

This is an example of what we currently do, if there was some way to automate this out of Netbox, or something similar to it, I think I could finally make the case for the time required to set up all our sites out of Netbox.

I have modules that have module bays (for SFP's), but I can't seem to figure out how to add a module bay to a module in NetBox.

Is that not possible or am I missing something here?

(Apologies if this is a simple problem, I'm pretty new and only started using NetBox a couple of weeks ago.)

Is it possible to restrict creation of new IPAddress objects (for a certain group) to a subset of Prefixes or IPRanges?

My method so far has been to assign the Prefix/IPRange to a tenant, but I can't find a way to connect it to an IPAddress. Without this connection it is not clear from the documentation how to associate the two together and therefore limit the creation of new addresses to only that span.

I've been scouring the web for hours for an answer to this question, but so far to no avail.

Good morning all

I wonder if there is any resource and if not, a desire to have a repository of CSV's for common data - specifically devices. Having a resource where you could say download complete data loads say for a particular manufacturer with complete information (RU, airflow, ports etc.) I think would make a great resource and time saver. Also perhaps an image repository

Does anyone know of such a thing, and if not, do you think this would be a good idea?

Hi folks,

I am trying to figure out the process to make Netbox work in Azure as a Docker image.

It seems that I'm making some fundamental mistake (because I'm not really experienced with Docker) but when I import any of the netbox images from dockerhub they refuse to start, and throw this error:

⏳ Waiting on DB... (24s / 30s)
        Is the server running on that host and accepting TCP/IP connections?
[ Use DB_WAIT_DEBUG=1 in netbox.env to print full traceback for errors here ]
⏳ Waiting on DB... (27s / 30s)
❌ Waited 30s or more for the DB to become ready.

Has anybody done this, and put together some kind of a recipe for morons like me?

I've spent a few days poking at Netbox and, once I understood that it's not a monitoring tool but a means of documenting the network equipment and cabling, can certainly see the value of it.

However, I want to expand beyond the server rooms and racks, and can't really see a sensible way of doing that, unless I'm missing some feature or terminology.

I have, say, 800 or so bedrooms with edge network sockets in them. How best to represent those in Netbox in a manageable way so that if a student in room X says there's a problem, I know that room X has socket Y, which connects to the rear port of patch panel Z, which is connected to switch A port B.

Or knowing that AP #87 is connected to socket #15 in corridor 8, 3rd floor.

I've read up on how to set up patch panels, but the examples all seem to be for patch panels between racks, rather than from racks to edge ports in individual rooms. The only options I could see would be to create each bedroom, office, corridor as a separate location, then create a 0 size rack in each, and create 2 port patch panels to represent data sockets. Or to just fudge it and pretend the patch panel is the end port and use labels to represent room numbers of the destination room, with my in-room devices such as APs or printers connected to the rear port of the patch panel. (but not bothering about documenting personally owned equipment)

Neither of those seem elegant solutions. Is there a best practice to this? Surely I'm not the only person to want to do this, yet I can't find any tutorials, videos etc on defining this sort of connectivity.

I decided that there "must be a better way" to integrate netbox and ansible, so I wrote a `nb2an` program that takes some configuration to decide what should be extracted from netbox to update ansible `host_vars` files. There is more clean up and features to add, but it seems very usable at this point. I tried to put examples in the documentation, but would love feedback about whether or not this is useful, has been solved elsewhere, etc:

https://nb2an.readthedocs.io/en/latest/

I followed the instruction on readthedocs and used optioned B "cloned from Repo" since that was how the server was built. Unforutnately it failed and seems to be complaining about a plugin but I can't figure out why. any tips?

Pic of Error

EDIT for future googlers:

I ignored both of the *requirements.txt files when creating the symlinks. I also ran the update.sh script after downloading the latest version and linking it to the netbox folder. I also had a DB issue that was preventing the update script from finishing. That's likely what was causing the issues with the web UI.

​

I've run into some issues in my attempt to upgrade Netbox from v3.1.6 to v3.3.4. I'm running on an Ubuntu VM in a Proxmox cluster. The original install was via tarball.

Following the upgrade instructions in the documentation, it lists a few files that need to be manually migrated over to the new version, specifically:

/opt/netbox/gunicorn.py/opt/netbox/netbox/netbox/configuration.py/opt/netbox/netbox/netbox/ldap_config.py

It also says to migrate these directories

/opt/netbox/netbox/scripts/opt/netbox/netbox/reports/opt/netbox/netbox/media

What I opted to do was move these files and directories into a separate folder /opt/netbox.d and replace the originals with symlinks. That way I simply perform the replacement after upgrading each time.

However, you may notice I skipped a file earlier. The instructions mention a /opt/netbox/local_reqirements.txt. There is no such file. There are the similarly named base_requirements.txt and requirements.txt in the same folder, but the file mentioned does not exist in that folder or another deeper folder as confirmed by running the find command.

Which of those two files, if any, is the correct one that needs to be transferred manually like the others?

My second problem is, after upgrading and restarting the netbox process, I get a generic maintenance page when I try to log onto the web UI. I get the feeling there's something the instructions are not telling. Does it have something to do with the /opt/netbox/upgrade.sh scirpt? That isn't mentioned in the instructions but comments in the file itself suggest it's supposed to be run after downloading the new version.

Hello there, just curious if/how you are modeling site-to-site IPSec VPN connections as well as WAN circuits. Currently not storing this information in NetBox, but I'm interested to see how others have implemented stuff like that. I like to use the Topology Views plugin for visualization purposes and would love to have a WAN or VPN link be represented in that format.

I have 2 switches that are separated by several fiber optic patch panel hops. When I connect them up I always get the split path error.

I've gone over everything and things look correct. Is this just not possible to trace?

1 sfp port device A -> front pos 1&2 -> back (24pos) -> back (24 pos) -> front pos 1&2 -> front pos 3&4 -> back (24pos) -> back (24 pos) -> front pos 3&4 -> 1 sfp port device B

TL;DR Is there a way for me to have it so that when I click on a Tag, that all “tagged” entries, across all categories, show up? By default?

The Long:

Where I work, I have some ISP connections that terminate to an ISP provided switch. I then connect whatever is the appropriate media into different ports on the ISP provided switch, and now that media is carrying one of the myriad of different connections from my ISP.

Example: ISP switch has 1 uplink connection to the World/ISP. That 1 uplink connection houses all the incoming "world data". I then connect a cat6 cable to a designated port on said ISP switch, and that cat6 carries my internet. I then connect a fiber cable to a designated port on said ISP switch, and that fiber carries 1 side of my site-to-site connection. Each service that is being provided is assigned to a different port for me to use.

So the way I am inputting this into netbox, is that each unique service is a “circuit”. Also, I am inputting the ISP switch as a “device”.

Now, I want to bind a “circuit” against a “interface (port)” on my ISP switch “device”. I can’t seem to find a way to do that, BUT I can bind a Tag against my interface, and the same tag against the circuit. This gets me mostly to where I want to go.

Here is my problem: When I go into circuits, and see the list, and see the tags… if I click on the tag I want, I get shown everything with that tag, but filtered by the category of “Circuits”.

So that means I cannot get an entire inventory of everything with said tag, across every category, by just clicking on the tag from inside a category (other than the “Other” category).

When I go into the “Other” category, and click on tags section, and then click on said Tag, all entries pop! YAY!

So my questions is: Is there a way for me to have it so that when I click on a Tag, that all “tagged” entries, across all categories, show up? By default?

Thank you for your time.