starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Enforce Prefix and IP-Address Uniqueness among different VRFs #6225

New Issue
Closed
opened 2025-12-29 19:38:12 +01:00 by adam · 9 comments
adam commented 2025-12-29 19:38:12 +01:00
Owner
Copy Link

Originally created by @ChrisDeh on GitHub (Mar 17, 2022).

NetBox version

v3.1.9

Feature type

New functionality

Proposed functionality

I'd like to propose to add a feature for enforcing uniqueness of IP-Addresses and Prefixes among different VRFs based on the Aggregate they belong to.
One way of implementation could be the "Private" Option of a RIR. If a RIR is private, IP-Space/Prefixes can be double used. If a RIR is non-private, IP-Addresses and Prefixes have to be unique within one Aggregate (of course except for Roles like VRRP, etc.).

Use case

Sometimes it's more handy to track the VRFs and the IP-Adresses/Prefixes used within the Network with their explicit VRF Name, even if they represent in the end the "Global Routing Table".
For example you have one Part of your Network where the Global Routing Table is within a VRF called "inet" and in another Part of your Network, your global Routing Table is inside VRF "internet".
There is some Point, where they are routed together, but for generating configuration based on documentation, you'd like to track these VRFs in your documentation.

There are very rare and little use cases, where IP-Addresses assigned by a RIR are used multiple times in differnt VRFs in the Network. For that reason, it would prevent accidential double allocation by enforcing uniqueness on a Aggregate Level.

Database changes

No response

External dependencies

No response

Originally created by @ChrisDeh on GitHub (Mar 17, 2022). ### NetBox version v3.1.9 ### Feature type New functionality ### Proposed functionality I'd like to propose to add a feature for enforcing uniqueness of IP-Addresses and Prefixes among different VRFs based on the Aggregate they belong to. One way of implementation could be the "Private" Option of a RIR. If a RIR is private, IP-Space/Prefixes can be double used. If a RIR is non-private, IP-Addresses and Prefixes have to be unique within one Aggregate (of course except for Roles like VRRP, etc.). ### Use case Sometimes it's more handy to track the VRFs and the IP-Adresses/Prefixes used within the Network with their explicit VRF Name, even if they represent in the end the "Global Routing Table". For example you have one Part of your Network where the Global Routing Table is within a VRF called "inet" and in another Part of your Network, your global Routing Table is inside VRF "internet". There is some Point, where they are routed together, but for generating configuration based on documentation, you'd like to track these VRFs in your documentation. There are very rare and little use cases, where IP-Addresses assigned by a RIR are used multiple times in differnt VRFs in the Network. For that reason, it would prevent accidential double allocation by enforcing uniqueness on a Aggregate Level. ### Database changes _No response_ ### External dependencies _No response_
adam added the type: featurepending closurestatus: under review labels 2025-12-29 19:38:12 +01:00
adam closed this issue 2025-12-29 19:38:12 +01:00
adam commented 2025-12-29 19:38:13 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Mar 18, 2022):

I think we have most of what we need in place already, with the import/export.

I don't think using Aggregate or RIR would make sense, it would be better off if we had a checkbox on the prefix which controlled this behaviour.

@DanSheps commented on GitHub (Mar 18, 2022): I think we have most of what we need in place already, with the import/export. I don't think using Aggregate or RIR would make sense, it would be better off if we had a checkbox on the prefix which controlled this behaviour.
adam commented 2025-12-29 19:38:13 +01:00
Author
Owner
Copy Link

@PieterL75 commented on GitHub (Mar 21, 2022):

Feels al like my proposal to create Layer 3 domains. #7608
Our 10.0.0.0/8 are split into many small vrf's. The vrfs link to a firewall, and from there to a general vrf that routes between the firewalls.
Currently there is no mechanisms to make sure that prefixes are unique across vrf's.
A L3 domain that contains the vrfs that need to contain unique ip space would solve that..
(Especially if you know that we have multiple usages of the 10/8 ranges, with overlapping ranges. Uniqueness per L3 domain is critical)

@PieterL75 commented on GitHub (Mar 21, 2022): Feels al like my proposal to create Layer 3 domains. #7608 Our 10.0.0.0/8 are split into many small vrf's. The vrfs link to a firewall, and from there to a general vrf that routes between the firewalls. Currently there is no mechanisms to make sure that prefixes are unique across vrf's. A L3 domain that contains the vrfs that need to contain unique ip space would solve that.. (Especially if you know that we have multiple usages of the 10/8 ranges, with overlapping ranges. Uniqueness per L3 domain is critical)
adam commented 2025-12-29 19:38:14 +01:00
Author
Owner
Copy Link

@ChrisDeh commented on GitHub (May 15, 2022):

@DanSheps Maybe a proper way for implementing this is adding the possibility to Import/Export from/to NetBox' Default VRF - that would cover the real configuration on those devices in a very accurate way as well.

@ChrisDeh commented on GitHub (May 15, 2022): @DanSheps Maybe a proper way for implementing this is adding the possibility to Import/Export from/to NetBox' Default VRF - that would cover the real configuration on those devices in a very accurate way as well.
adam commented 2025-12-29 19:38:14 +01:00
Author
Owner
Copy Link

@empusas commented on GitHub (Jul 1, 2022):

I think the way VRF is used in net box is wrong anyway. I assume most people confuse a VRF with a routing domain or a L3 VPN like in MPLS.
A VRF is a local configuration on a device, it can have a different name on each device. You can connect different VRFs that route different prefixes together, you can do route leaking between VRF´s etc. That might be slightly different for technologies like Cisco ACI.

@empusas commented on GitHub (Jul 1, 2022): I think the way VRF is used in net box is wrong anyway. I assume most people confuse a VRF with a routing domain or a L3 VPN like in MPLS. A VRF is a local configuration on a device, it can have a different name on each device. You can connect different VRFs that route different prefixes together, you can do route leaking between VRF´s etc. That might be slightly different for technologies like Cisco ACI.
adam commented 2025-12-29 19:38:15 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Jul 2, 2022):

It may be unique to the device, however in most places you would maintain the same VRFName with the RD across devices.

You may use the same name on other devices with a different RD, but in most places I have seen, the VRF name is consistent

@DanSheps commented on GitHub (Jul 2, 2022): It may be unique to the device, however in most places you would maintain the same VRFName with the RD across devices. You may use the same name on other devices with a different RD, but in most places I have seen, the VRF name is consistent
adam commented 2025-12-29 19:38:15 +01:00
Author
Owner
Copy Link

@PieterL75 commented on GitHub (Jul 2, 2022):

Back to my Layer3 Domain proposal🤪
#7608

@PieterL75 commented on GitHub (Jul 2, 2022): Back to my Layer3 Domain proposal🤪 #7608
adam commented 2025-12-29 19:38:15 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jul 5, 2022):

A VRF is a local configuration on a device, it can have a different name on each device.

What you're describing is commonly referred to as "VRF lite." VRFs is NetBox were built to model full MPLS/VPN-capable VRFs as defined in RFC 4364, which employ route distinguishers to extend discrete, isolated routing domains over multiple node.

@jeremystretch commented on GitHub (Jul 5, 2022): > A VRF is a local configuration on a device, it can have a different name on each device. What you're describing is commonly referred to as "VRF lite." VRFs is NetBox were built to model full MPLS/VPN-capable VRFs as defined in [RFC 4364](https://www.rfc-editor.org/rfc/rfc4364), which employ route distinguishers to extend discrete, isolated routing domains over multiple node.
adam commented 2025-12-29 19:38:15 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 4, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Do not attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Sep 4, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. **Do not** attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 19:38:16 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 5, 2022):

This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.

@github-actions[bot] commented on GitHub (Oct 5, 2022): This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pending closure status: under review type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6225
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?