use REST API to get virtual machines inside vlan

[nlameiras]

Hello,

my netbox version : 3.1.11

I have modeled all vlans, prefixes, ip adresses, devices and virtual machines (and their interfaces) of our network in our netbox. It works great!

I'm now searching for a way to use REST API to get all servers (devices + virtual machines) inside a vlan.
So far, I was not able to do so by using filtering proposed on documentation. Is there a way to achieve this ?

regards,
Nelson

[candlerb]

There's no direct link between device or virtual machine and VLAN. The relationships you have are:

• device -> interfaces -> IPs -> prefix -> VLAN
• virtualmachine -> vminterfaces -> IPs -> prefix -> VLAN

So you need to first do a query which finds all prefixes in the VLAN of interest:

>>> v = nb.ipam.vlans.get(name='mgmt-dmz')
>>> v.id
2
>>> p = list(nb.ipam.prefixes.filter(vlan_id=2))
>>> p
[10.12.255.0/24, 2001:db8::/64]

Then you need to do a query to find all the IP addresses within each prefix, and see which ones have been assigned to a device interface or vm interface.

>>> i = list(nb.ipam.ip_addresses.filter(parent="10.12.255.0/24"))
>>> len(i)
49
>>> len([j for j in i if j.assigned_object_type == 'dcim.interface'])
10
>>> len([j for j in i if j.assigned_object_type == 'virtualization.vminterface'])
38
>>> i[0].assigned_object_type
'dcim.interface'
>>> i[0].assigned_object.device
gw2
>>> i[0].assigned_object.device.id
64

There is also a filter "assigned_to_interface" which will eliminate the addresses not assigned to any interface. On my system this reveals a minor anomaly: look at the the number of addresses assigned to 'dcim.interface', it has fallen from 10 to 8.

>>> i = list(nb.ipam.ip_addresses.filter(parent="10.12.255.0/24",assigned_to_interface=True))
>>> len(i)
46
>>> len([j for j in i if j.assigned_object_type == 'dcim.interface'])
8
>>> len([j for j in i if j.assigned_object_type == 'virtualization.vminterface'])
38
>>> i = list(nb.ipam.ip_addresses.filter(parent="10.12.255.0/24",assigned_to_interface=False))
>>> len(i)
3
>>> i[0].assigned_object_type
'dcim.interface'
>>> i[1].assigned_object_type
'dcim.interface'
>>> i[2].assigned_object_type
'ipam.fhrpgroup'
>>> i[0].assigned_object_id
>>> i[1].assigned_object_id
>>> i[2].assigned_object_id
4
>>>

There are two IP addresses in this prefix which have assigned_object_type as dcim.interface but are not actually assigned to an interface (i.e. the assigned object id is null).

Digging a bit further into the database:

netbox=# select count(*) from ipam_ipaddress where assigned_object_type_id is not null and assigned_object_id is null;
 count
-------
     7
(1 row)

netbox3=# select assigned_object_type_id,count(*) from ipam_ipaddress where assigned_object_type_id is not null and assigned_object_id is null group by assigned_object_type_id;
 assigned_object_type_id | count
-------------------------+-------
                      17 |     7
(1 row)

Somehow, these IP addresses, which are not attached to any device instance, still have assigned_object_type_id saying it's a device. However this seems harmless enough, and the assigned_to_interface=True filter correctly removes them from the result set.

[nlameiras]

Thank you so much for this complete answer! It's very clear. So I assume there is no easy way to do this using REST API (via curl).
I'll try to address it using what you proposed since I'm no stranger to python and postgres.

I'm still learning all different ways to interact with netbox, but I'm not sure how to easily propose the result on netbox (either by GUI or REST). Should I implement it via a plugin? via a script? via an export template ? Is there an obvious way to do it ? Any clues you can give me to get started would be great !

For context : I need to give an "1-click" way to our operations teams to get a list of servers inside certain VLANs.

[candlerb]

Sure you can do it via curl. You didn't say whether you were using curl or pynetbox to talk to the REST API, so I just picked pynetbox.

Here's doing the same thing with curl:

$ curl -gsS -H "Authorization: Token $API_TOKEN" "https://netbox.example.net/api/ipam/vlans/?name=mgmt-dmz" | jq '.results[].id'
2
$ curl -gsS -H "Authorization: Token $API_TOKEN" "https://netbox.example.net/api/ipam/prefixes/?vlan_id=2" | jq -r '.results[].prefix'
10.12.255.0/24
2001:db8::/64
$ curl -gsS -H "Authorization: Token $API_TOKEN" "https://netbox.example.net/api/ipam/ip-addresses/?parent=10.12.255.0%2F24&assigned_to_interface=True" | jq '.results[].assigned_object'
{
  "id": 447,
  "url": "https://netbox.example.net/api/dcim/interfaces/447/",
  "display": "vlan255",
  "device": {
    "id": 64,
    "url": "https://netbox.example.net/api/dcim/devices/64/",
    "display": "gw2",
    "name": "gw2"
  },
  "name": "vlan255",
  "cable": null,
  "_occupied": false
}
.... etc

I need to give an "1-click" way to our operations teams to get a list of servers inside certain VLANs.

It sounds then that you'd prefer this to be in the Netbox GUI rather than REST API. If you do it via the REST API then you'll need to write an external script or web server that talks to the API.

If you want the user to be able to choose the VLAN from a drop-down, then a Custom Script will be the easiest way to do this. The output can take the form of "log" messages, which can be in Markdown format and include hyperlinks to devices/VMs.

If it's a fixed VLAN, then you can also write a Report which generates the same sort of output - but reports don't have parameters.

If it's genuinely "one click" that you want, then you could create a Custom Link on the VLAN page, which links to your report or script. Someone was asking here previously if it was possible to make use of query parameters in the URL (e.g. so you can link to myscript?vlan_id=123) and I think it was possible, but you'd have to dig back through the archives.

EDIT: It was here. A bit of a hack to override as_form on your custom script class.