Enforce uniqueness for private address space

[rizlas]

Hi,
I was wondering why this issue was closed (@jeremystretch). This is a legit use case and us too are wondering how to tackle this. We would like to avoid creating fake vrfs to separate private address spaces in particular.

How do you guys "fix" this problem?

Its like the example one provided by @dmulyalin

Example - 1.

Two companies merge together, both having IT department that uses 192.168.0.0/16 space to IP corporate networks, both use global routing table to route the traffic. Each company has enforced uniqueness of IP addresses within their corp network. Each company modeled as a tenant in Netbox with "ENFORCE_GLOBAL_UNIQUE" set to False to accomodate overlapping IP addresses, but we now have a problem - how do we enforce IP uniqueness in Netbox for each of the networks individually? Possible answers are:

we don't, we simply hope people will do their due diligence and will not allocate duplicate IP addresses for each network
we create "fake" VRFs - org1-default and org2-default and use those VRF to document IP addresses and enforce uniqueness

either of above approaches is suboptimal, for the 1st one - hope is not a good strategy, for the 2nd we have to create ephemeral entities in Netbox to workaround its limitations.

[candlerb]

The answer today is, "create VRFs".

A "VRF" in Netbox does not just represent an actual router-level VRF, it also represents a network namespace - a zone of uniqueness if you like.

So if you create a VRF for "org2-default" and put org2's prefixes and IP addresses in there, it will solve your problem. For politicial reasons you might also need to create an "org1-default" VRF, so that one org doesn't appear to be more important than the other.

This is not an entirely inaccurate modeling. Clearly, if the two orgs are both using 192.168.0.0/16, then they must have their own global routing tables, and therefore the routing tables are distinct. If you consider them as one network, then they'd have to be in their own VRFs.

Personally speaking: I would like to see Netbox separate the concepts of "network namespace" and "VRF", so you can have multiple VRFs within the same network namespace. For example, the inside and outside of your firewall may be in different VRFs, but you want to have a unique addressing plan across the two. It's been suggested several times over the years and rejected; you can search through old issues for specific proposals.

(But if that were done, the "global routing table for org1's namespace" and the "global routing table for org2's namespace" would still be implicitly two different routing tables)

[jsenecal]

FWIW @rizlas, @candlerb describes exactly how this is done in Netbox (and how I do it). I also totally second the idea of network namespaces.

[rizlas]

Thank you @candlerb and @jsenecal , thats clear all. I asked because I thought that we were tackling the problem in a wrong way. Also agree on a possible network namespaces feature, hope it'll land sooner or later.