A way to separate the IPAM Object by environments

[eprothon]

NetBox version

v3.4.4

Feature type

New functionality

Proposed functionality

We need to have a real way to separate the IPAM’s objects between our different environments PROD/STAGING/DEV.

Use case

We use a unique instance of Netbox to configure our different datacenters. Our developers use Netbox also to manage our different isolated environments PROD/STAGING/DEV with overlap of prefix and IP addresses.
In this context, we need to have a real way to separate the IPAM’s objects between the different environments.
We have tried to use tenant-groups and tenants without success. We have also tried VRF as a way to achieve this separation.
However, such VRF is only useful for the user interface in Netbox but is confusing for operators as it does not really represent the reality and they should not configure it.

Database changes

No response

External dependencies

No response

[stavr666]

Combination of VRF, VLAN and Tenant does not work for you either? We have no separate dev network right now, but planning to do so.

Can you show example screenshots of artefacts (from Demo), that you experience, when use filters with both Tenant and VRF defined? For operators you can limit visibility by either of this 3 options, afaik.

[eprothon]

Here we tried using the tenant-groups and tenants to separate our environnements.
We have two use cases :

1. without vrf

2. with the same vrf configured on both environnement
   

[jeremystretch]

Converting this to a discussion as no specific implementation has been proposed.

[eprothon]

Hi @jeremystretch , here is my thought :

1. Adding a new object Environment into Organisation.
2. Any IPAM's objects will be able to be linked with an environment. Not mandatory.
3. No impact on IPAM's objects that are no linked to an environment.
4. However, for IPAM's objects linked to an environment
   4.1. such as prefix, for instance, it will only count and show its IP adresses that are in the same environment.
   4.2. such as vrf, for instance, it will permit to have duplicates if in différent environments.

[PieterL75]

for the IP part... Create a VRF per 'environment'. then you have the isolation you need.
It allows overlapping IP space, because they need to be unique within the VRF.

[eprothon]

Hi, thanks for your reply. However this is one of our issue. There are already VRFs configured on each environment and for those IPs without VRF, if we create VRF just for the Netbox IPAM isolation purpose, they will be 'fake'. And we don't want the risk to have 'fake' elements on our Source of Truth that are not really configured. Apologies for my poor english.

[gdprdatasubect]

How about just using tags?

[eprothon]

Hi @gdprdatasubect, thanks for your reply. We've tried that also and as it helps the user to différentiate where the IP is used. However it does not respond to the root need here which is to seperate IPAM counting and also functionnalities such as next_ip per enviromnent.