IPAM DHCP Scope reservation

[anders-nc]

Hi,
I have tested several variant and it almost feels that im missing something.
We want to have a reservation on a prefix for a range of addresses used by our DHCP, and they should not be able to be used , but in the ip address view it says all adreses in the prefix is availible even when i have created a range between 192.168.136.50/24-192.168.136.199/24 as RESERVED (see pictures)
It should not say Reserved in the IP address list for the prefix ?

[candlerb]

This is because there are separate tabs for "Child Ranges" and "[Child] IP Addresses" for a prefix.

A unified view would be very nice to have, but it doesn't exist.

EDIT: there is an open issue from 2 years ago, #9763, but I'm sure it has been asked for before that. Ah yes: #6934

[markkuleinio]

Yeah, I'm currently planning to ~12-fold the number of IP address objects in one of my NetBoxes, to get people from misunderstanding "Available" IPs as available

[anders-nc]

So there actually not preventing a user from adding an adress in that range ( i just tested) even if its reserved?
Is this by design? our users at least find it confusing, they can add an address although its in reserved space and don't even get an warning about it.
The issue is that we have discovered many many faulty addresses that are in these ranges on lots of our prefixes, so its a mess.
It getting harder for us who loves Netbox to sell in when it as this behavior.

[candlerb]

So there actually not preventing a user from adding an adress in that range ( i just tested) even if its reserved?
Is this by design?

Yes. Ranges and IP Addresses are completely independent objects. See #9763 for the long-standing feature request to address this, at least for 'reserved' ranges.

The issue is that we have discovered many many faulty addresses that are in these ranges on lots of our prefixes, so its a mess

For now, the best way to address this is either to run a report periodically (to identify the mess and clean it up retrospectively), or to write a Custom Validator which checks for an overlapping Range before creating a new IPAddress.

[anders-nc]

I looked about custom validation rules in the reference site, looks like the way to go for now :-)
But i really struggle with the code here for checking if an ip address already is in a reserved ip range or already present.
I see i must enter it in the configurration.py but need some example to get starting. ( not yet an python coder more a powershell guy )

[candlerb]

There are some samples at https://github.com/netbox-community/customizations/tree/master/custom_validators

You can test ORM code interactively using nbshell which is best started like this:

/opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py nbshell

So really you're just looking for a query to find any IPRange(s) which contain a given IP address.

# /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py nbshell
### NetBox interactive shell (netbox4)
### Python 3.12.3 | Django 5.0.9 | NetBox 4.0.11
### lsmodels() will show available models. Use help(<model>) for more info.
>>> IPRange.objects.all()
<RestrictedQuerySet [<IPRange: 10.12.0.100-249/24>, <IPRange: 10.12.253.200-249/24>, <IPRange: 10.12.254.100-199/24>, <IPRange: 10.12.254.200-249/24>, <IPRange: 10.12.255.200-239/24>, <IPRange: 10.12.255.240-249/24>, <IPRange: 192.168.0.100-249/24>]>
>>> ip="10.12.255.242/24"
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet [<IPRange: 10.12.255.240-249/24>]>

Sadly though, Netbox's insistence on storing a netmask with every IP address makes this difficult to use if you don't actually know the right prefix length. The following queries don't find what you want:

>>> ip="10.12.255.242"
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet []>
>>> ip="10.12.255.242/32"
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet []>
>>> import netaddr
>>> ip = netaddr.IPNetwork('10.12.255.242')
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet []>
>>> ip = netaddr.IPAddress('10.12.255.242')
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet []>

I don't have a solution here, short of trying every possible prefix length in a loop.

[lopar]

So there actually not preventing a user from adding an adress in that range ( i just tested) even if its reserved?

Well, technically, you can add IP-address manually inside existing DHCP pool in existing network. Not the DHCP reservation, but exact static manually configured ip address. That's why it is not a good idea to prohibit user adding custom addresses in existing ranges.