IPAM¶
IPAM is the address ledger — and, more usefully, the place where the ledger is checked against what the network is actually configured to do.
The module is titled Network Resource Center in the product: it is the single source of truth for network resources, continuously reconciled against the live network.
Structure¶
| Section | Holds |
|---|---|
| Overview | Counts for VRFs, prefixes, IP addresses, VLANs, ASNs and aggregates; open discrepancies broken down into conflict / duplicate / orphaned / missing; and a top capacity pressure table of the prefixes closest to full |
| Subnets | Aggregates, prefixes, IP ranges and IP addresses, in a folder tree |
| VRFs | Routing instances — and the scope in which addresses are unique |
| VLANs | VLAN registry, scoped by site or group |
| ASN | Autonomous system numbers |
| RIRs | Regional registries and the aggregates delegated from them |
| Providers | Circuits and the providers behind them |
| Reconcile | Ledger against reality — Run reconcile is on the overview page |
| IP Calculator | Subnet arithmetic without leaving the page |
| Migration | Bulk import from an existing system |
Roles, tenants, VRFs and ASNs are first-class objects, so a prefix can be attributed to a tenant, placed in a VRF and given a role without free-text fields doing the work.
Reading the overview¶
The four discrepancy counters are the ones worth watching daily:
- Conflict — two records claim the same address in the same VRF.
- Duplicate — the same address recorded twice.
- Orphaned — configured on the network, absent from the ledger.
- Missing — in the ledger, not found on the network.
Top capacity pressure sorts prefixes by utilization, so the /24 at 93% shows up before somebody runs out of addresses at 2am rather than after.
VRF scoping¶
Addresses are unique within a VRF, not globally. Overlapping RFC 1918 space in separate VRFs is normal in carrier and multi-tenant networks, and a ledger that cannot express it will reject correct data. Assign the VRF when you create the prefix.
Reconciliation¶
The reconcile tab compares IPAM records against addresses found in device configurations by Config Insight, and lists what differs.
Two-way, and never automatic
Differences are shown, not applied. An address in the configuration but not in the ledger may be a missing record — or configuration that should have been removed. Auto-syncing either direction would eventually corrupt both sides, so the judgement stays with you.
Migration¶
The migration tab does bulk import from an existing IPAM. Bring the data across, reconcile it against the network once, and you will usually find the first batch of ledger errors within the hour.