How to manage the ranges and IPs identical of several sites?

[LeDistordu]

Hi,

Currently Ips and ranges are not linked to sites. I am currently testing netbox which is a great project with a great future. From the start I am confronted with the fact that I have several sites with the same ranges or the same IPs.

How to do ? IPs and Ranges should not be assignable to a site or a vlan ?

[candlerb]

Addresses are indirectly associated with prefixes, in the sense that the address is implicitly within a prefix; and prefixes can be associated with sites and/or vlans (which in turn can also be associated to site or VLAN group).

To deal with overlapping IP addresses, you create "VRFs" in Netbox. These really represent "network namespaces", i.e. zones of uniqueness. IP Addresses, Prefixes and Ranges are all directly associated with a VRF.

(This is different to how you might actually deploy VRFs: for example, a firewall might have its inside interface in one VRF and its outside interface in a different VRF for traffic isolation, but you'd want the inside/outside IP addressing to be non-overlapping, and to achieve that in Netbox means you'd have to model it as a single Netbox "VRF")

This indirect linkage between IP address and site means it's difficult to use in permission rules. for example, "you can only create an IP address within a prefix that belongs to one of the sites you have access to". I think it would be easier to express in terms of the VRF rather than the site, if you give each site its own VRF, which you'd have to for overlapping addresses anyway.

Otherwise, if isolation is important, you may want to consider running multiple Netbox instances, one for each site.

[LeDistordu]

Hi,

For example i have several independent sites that use private network class : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

as it is now, if I declare the range

Site A = 172.16.30.0/24
Site B = 172.16.30.0/24

I add IP for site A, 172.16.30.100, i can see this IP in IP Addresses in Prefixe Site A and Site B

I have the impression that Netbox's IPAM is not adapted for the moment to manage several customers but rather to manage several sites of the same customer.

But linking IPs and ranges to a site/VLAN would be a good solution. Or add a notion of customer above the sites?

One Netbox by customer is too heavy, especially if you want to document small customers.

[candlerb]

I add IP for site A, 172.16.30.100, i can see this IP in IP Addresses in Prefixe Site A and Site B

Yes: or, if you set ENFORCE_GLOBAL_UNIQUE=True, then you'll get an error when you try to add the second one. And if you look under the 172.16.30.0/24 prefix, you'll see a mixture of site A and site B addresses. That's not what you want, because these are two separate networks.

The solution is that site A should be adding their addresses in VRF A, and site B in VRF B - not in the global VRF - and there should be two 172.16.30.0/24 prefixes, again one in VRF A and one in VRF B.

[ujithaGitHub]

I too need to use same IP address for two different sites. Actually I need to document BGP session in Netbox for my IX peerings. So two routers in two different sites need to peer same IP address. Here I have used private IP range only for sharing externally, I can not expose real IPs. So I am facing an issue that I can not assign same IP and same IP range for two sites on BGP session document.

Kindly expect a answer for my issue.

[candlerb]

That's a single layer 2 domain, with a single prefix, and every router has a unique IP address, so everything looks perfectly fine to me.

The only issue I can see is that the prefix and the VLAN cannot be linked to multiple sites. You leave the "site" field unset, to document that this VLAN spans 2 or more sites, but you can't say exactly which sites.