feat(plugins): implement Sprint 4 commands (#241-#258)
Sprint 4 - Plugin Commands implementation adding 18 new user-facing commands across 8 plugins as part of V5.2.0 Plugin Enhancements. **projman:** - #241: /sprint-diagram - Mermaid visualization of sprint issues **pr-review:** - #242: Confidence threshold config (PR_REVIEW_CONFIDENCE_THRESHOLD) - #243: /pr-diff - Formatted diff with inline review comments **data-platform:** - #244: /data-quality - DataFrame quality checks (nulls, duplicates, outliers) - #245: /lineage-viz - dbt lineage as Mermaid diagrams - #246: /dbt-test - Formatted dbt test runner **viz-platform:** - #247: /chart-export - Export charts to PNG/SVG/PDF via kaleido - #248: /accessibility-check - Color blind validation (WCAG contrast) - #249: /breakpoints - Responsive layout configuration **contract-validator:** - #250: /dependency-graph - Plugin dependency visualization **doc-guardian:** - #251: /changelog-gen - Generate changelog from conventional commits - #252: /doc-coverage - Documentation coverage metrics - #253: /stale-docs - Flag outdated documentation **claude-config-maintainer:** - #254: /config-diff - Track CLAUDE.md changes over time - #255: /config-lint - 31 lint rules for CLAUDE.md best practices **cmdb-assistant:** - #256: /cmdb-topology - Infrastructure topology diagrams - #257: /change-audit - NetBox audit trail queries - #258: /ip-conflicts - Detect IP conflicts and overlaps Closes #241, #242, #243, #244, #245, #246, #247, #248, #249, #250, #251, #252, #253, #254, #255, #256, #257, #258 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "cmdb-assistant",
|
||||
"version": "1.1.0",
|
||||
"version": "1.2.0",
|
||||
"description": "NetBox CMDB integration with data quality validation - query, create, update, and manage network devices, IP addresses, sites, and more with best practices enforcement",
|
||||
"author": {
|
||||
"name": "Leo Miranda",
|
||||
|
||||
@@ -2,6 +2,12 @@
|
||||
|
||||
A Claude Code plugin for NetBox CMDB integration - query, create, update, and manage your network infrastructure directly from Claude Code.
|
||||
|
||||
## What's New in v1.2.0
|
||||
|
||||
- **`/cmdb-topology`**: Generate Mermaid diagrams showing infrastructure topology (rack view, network view, site overview)
|
||||
- **`/change-audit`**: Query and analyze NetBox audit log for change tracking and compliance
|
||||
- **`/ip-conflicts`**: Detect IP address conflicts and overlapping prefixes
|
||||
|
||||
## What's New in v1.1.0
|
||||
|
||||
- **Data Quality Validation**: Hooks for SessionStart and PreToolUse that check data quality and warn about missing fields
|
||||
@@ -59,6 +65,9 @@ Add to your Claude Code plugins or marketplace configuration.
|
||||
| `/cmdb-audit [scope]` | Data quality analysis (all, vms, devices, naming, roles) |
|
||||
| `/cmdb-register` | Register current machine into NetBox with running apps |
|
||||
| `/cmdb-sync` | Sync machine state with NetBox (detect drift, update) |
|
||||
| `/cmdb-topology <view>` | Generate Mermaid diagrams (rack, network, site, full) |
|
||||
| `/change-audit [filters]` | Query NetBox audit log for change tracking |
|
||||
| `/ip-conflicts [scope]` | Detect IP conflicts and overlapping prefixes |
|
||||
|
||||
## Agent
|
||||
|
||||
@@ -140,9 +149,12 @@ cmdb-assistant/
|
||||
│ ├── cmdb-device.md # Device management
|
||||
│ ├── cmdb-ip.md # IP management
|
||||
│ ├── cmdb-site.md # Site management
|
||||
│ ├── cmdb-audit.md # Data quality audit (NEW)
|
||||
│ ├── cmdb-register.md # Machine registration (NEW)
|
||||
│ └── cmdb-sync.md # Machine sync (NEW)
|
||||
│ ├── cmdb-audit.md # Data quality audit
|
||||
│ ├── cmdb-register.md # Machine registration
|
||||
│ ├── cmdb-sync.md # Machine sync
|
||||
│ ├── cmdb-topology.md # Topology visualization (NEW)
|
||||
│ ├── change-audit.md # Change audit log (NEW)
|
||||
│ └── ip-conflicts.md # IP conflict detection (NEW)
|
||||
├── hooks/
|
||||
│ ├── hooks.json # Hook configuration
|
||||
│ ├── startup-check.sh # SessionStart validation
|
||||
|
||||
163
plugins/cmdb-assistant/commands/change-audit.md
Normal file
163
plugins/cmdb-assistant/commands/change-audit.md
Normal file
@@ -0,0 +1,163 @@
|
||||
---
|
||||
description: Audit NetBox changes with filtering by date, user, or object type
|
||||
---
|
||||
|
||||
# CMDB Change Audit
|
||||
|
||||
Query and analyze the NetBox audit log for change tracking and compliance.
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
/change-audit [filters]
|
||||
```
|
||||
|
||||
**Filters:**
|
||||
- `last <N> days/hours` - Changes within time period
|
||||
- `by <username>` - Changes by specific user
|
||||
- `type <object-type>` - Changes to specific object type
|
||||
- `action <create|update|delete>` - Filter by action type
|
||||
- `object <name>` - Search for changes to specific object
|
||||
|
||||
## Instructions
|
||||
|
||||
You are a change auditor that queries NetBox's object change log and generates audit reports.
|
||||
|
||||
### MCP Tools
|
||||
|
||||
Use these tools to query the audit log:
|
||||
|
||||
- `extras_list_object_changes` - List changes with filters:
|
||||
- `user_id` - Filter by user ID
|
||||
- `changed_object_type` - Filter by object type (e.g., "dcim.device", "ipam.ipaddress")
|
||||
- `action` - Filter by action: "create", "update", "delete"
|
||||
|
||||
- `extras_get_object_change` - Get detailed change record by ID
|
||||
|
||||
### Common Object Types
|
||||
|
||||
| Category | Object Types |
|
||||
|----------|--------------|
|
||||
| DCIM | `dcim.device`, `dcim.interface`, `dcim.site`, `dcim.rack`, `dcim.cable` |
|
||||
| IPAM | `ipam.ipaddress`, `ipam.prefix`, `ipam.vlan`, `ipam.vrf` |
|
||||
| Virtualization | `virtualization.virtualmachine`, `virtualization.cluster` |
|
||||
| Tenancy | `tenancy.tenant`, `tenancy.contact` |
|
||||
|
||||
### Workflow
|
||||
|
||||
1. **Parse user request** to determine filters
|
||||
2. **Query object changes** using `extras_list_object_changes`
|
||||
3. **Enrich data** by fetching detailed records if needed
|
||||
4. **Analyze patterns** in the changes
|
||||
5. **Generate report** in structured format
|
||||
|
||||
### Report Format
|
||||
|
||||
```markdown
|
||||
## NetBox Change Audit Report
|
||||
|
||||
**Generated:** [timestamp]
|
||||
**Period:** [date range or "All time"]
|
||||
**Filters:** [applied filters]
|
||||
|
||||
### Summary
|
||||
|
||||
| Metric | Count |
|
||||
|--------|-------|
|
||||
| Total Changes | X |
|
||||
| Creates | Y |
|
||||
| Updates | Z |
|
||||
| Deletes | W |
|
||||
| Unique Users | N |
|
||||
| Object Types | M |
|
||||
|
||||
### Changes by Action
|
||||
|
||||
#### Created Objects (Y)
|
||||
|
||||
| Time | User | Object Type | Object | Details |
|
||||
|------|------|-------------|--------|---------|
|
||||
| 2024-01-15 14:30 | admin | dcim.device | server-01 | Created device |
|
||||
| ... | ... | ... | ... | ... |
|
||||
|
||||
#### Updated Objects (Z)
|
||||
|
||||
| Time | User | Object Type | Object | Changed Fields |
|
||||
|------|------|-------------|--------|----------------|
|
||||
| 2024-01-15 15:00 | john | ipam.ipaddress | 10.0.1.50/24 | status, description |
|
||||
| ... | ... | ... | ... | ... |
|
||||
|
||||
#### Deleted Objects (W)
|
||||
|
||||
| Time | User | Object Type | Object | Details |
|
||||
|------|------|-------------|--------|---------|
|
||||
| 2024-01-14 09:00 | admin | dcim.interface | eth2 | Removed from server-01 |
|
||||
| ... | ... | ... | ... | ... |
|
||||
|
||||
### Changes by User
|
||||
|
||||
| User | Creates | Updates | Deletes | Total |
|
||||
|------|---------|---------|---------|-------|
|
||||
| admin | 5 | 10 | 2 | 17 |
|
||||
| john | 3 | 8 | 0 | 11 |
|
||||
|
||||
### Changes by Object Type
|
||||
|
||||
| Object Type | Creates | Updates | Deletes | Total |
|
||||
|-------------|---------|---------|---------|-------|
|
||||
| dcim.device | 2 | 5 | 0 | 7 |
|
||||
| ipam.ipaddress | 4 | 3 | 1 | 8 |
|
||||
|
||||
### Timeline
|
||||
|
||||
```
|
||||
2024-01-15: ████████ 8 changes
|
||||
2024-01-14: ████ 4 changes
|
||||
2024-01-13: ██ 2 changes
|
||||
```
|
||||
|
||||
### Notable Patterns
|
||||
|
||||
- **Bulk operations:** [Identify if many changes happened in short time]
|
||||
- **Unusual activity:** [Flag unexpected deletions or after-hours changes]
|
||||
- **Missing audit trail:** [Note if expected changes are not logged]
|
||||
|
||||
### Recommendations
|
||||
|
||||
1. [Any security or process recommendations based on findings]
|
||||
```
|
||||
|
||||
### Time Period Handling
|
||||
|
||||
When user specifies "last N days":
|
||||
- The NetBox API may not have direct date filtering in `extras_list_object_changes`
|
||||
- Fetch recent changes and filter client-side by the `time` field
|
||||
- Note any limitations in the report
|
||||
|
||||
### Enriching Change Details
|
||||
|
||||
For detailed audit, use `extras_get_object_change` with the change ID to see:
|
||||
- `prechange_data` - Object state before change
|
||||
- `postchange_data` - Object state after change
|
||||
- `request_id` - Links related changes in same request
|
||||
|
||||
### Security Audit Mode
|
||||
|
||||
If user asks for "security audit" or "compliance report":
|
||||
1. Focus on deletions and permission-sensitive changes
|
||||
2. Highlight changes to critical objects (firewalls, VRFs, prefixes)
|
||||
3. Flag changes outside business hours
|
||||
4. Identify users with high change counts
|
||||
|
||||
## Examples
|
||||
|
||||
- `/change-audit` - Show recent changes (last 24 hours)
|
||||
- `/change-audit last 7 days` - Changes in past week
|
||||
- `/change-audit by admin` - All changes by admin user
|
||||
- `/change-audit type dcim.device` - Device changes only
|
||||
- `/change-audit action delete` - All deletions
|
||||
- `/change-audit object server-01` - Changes to server-01
|
||||
|
||||
## User Request
|
||||
|
||||
$ARGUMENTS
|
||||
182
plugins/cmdb-assistant/commands/cmdb-topology.md
Normal file
182
plugins/cmdb-assistant/commands/cmdb-topology.md
Normal file
@@ -0,0 +1,182 @@
|
||||
---
|
||||
description: Generate infrastructure topology diagrams from NetBox data
|
||||
---
|
||||
|
||||
# CMDB Topology Visualization
|
||||
|
||||
Generate Mermaid diagrams showing infrastructure topology from NetBox.
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
/cmdb-topology <view> [scope]
|
||||
```
|
||||
|
||||
**Views:**
|
||||
- `rack <rack-name>` - Rack elevation showing devices and positions
|
||||
- `network [site]` - Network topology showing device connections via cables
|
||||
- `site <site-name>` - Site overview with racks and device counts
|
||||
- `full` - Full infrastructure overview
|
||||
|
||||
## Instructions
|
||||
|
||||
You are a topology visualization assistant that queries NetBox and generates Mermaid diagrams.
|
||||
|
||||
### View: Rack Elevation
|
||||
|
||||
Generate a rack view showing devices and their positions.
|
||||
|
||||
**Data Collection:**
|
||||
1. Use `dcim_list_racks` to find the rack by name
|
||||
2. Use `dcim_list_devices` with `rack_id` filter to get devices in rack
|
||||
3. For each device, note: `position`, `u_height`, `face`, `name`, `role`
|
||||
|
||||
**Mermaid Output:**
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph rack["Rack: <rack-name> (U<height>)"]
|
||||
direction TB
|
||||
u42["U42: empty"]
|
||||
u41["U41: empty"]
|
||||
u40["U40: server-01 (Server)"]
|
||||
u39["U39: server-01 (cont.)"]
|
||||
u38["U38: switch-01 (Switch)"]
|
||||
%% ... continue for all units
|
||||
end
|
||||
```
|
||||
|
||||
**For devices spanning multiple U:**
|
||||
- Mark the top U with device name and role
|
||||
- Mark subsequent Us as "(cont.)" for the same device
|
||||
- Empty Us should show "empty"
|
||||
|
||||
### View: Network Topology
|
||||
|
||||
Generate a network diagram showing device connections.
|
||||
|
||||
**Data Collection:**
|
||||
1. Use `dcim_list_sites` if no site specified (get all)
|
||||
2. Use `dcim_list_devices` with optional `site_id` filter
|
||||
3. Use `dcim_list_cables` to get all connections
|
||||
4. Use `dcim_list_interfaces` for each device to understand port names
|
||||
|
||||
**Mermaid Output:**
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
subgraph site1["Site: Home"]
|
||||
router1[("core-router-01<br/>Router")]
|
||||
switch1[["dist-switch-01<br/>Switch"]]
|
||||
server1["web-server-01<br/>Server"]
|
||||
server2["db-server-01<br/>Server"]
|
||||
end
|
||||
|
||||
router1 -->|"eth0 - eth1"| switch1
|
||||
switch1 -->|"gi0/1 - eth0"| server1
|
||||
switch1 -->|"gi0/2 - eth0"| server2
|
||||
```
|
||||
|
||||
**Node shapes by role:**
|
||||
- Router: `[(" ")]` (cylinder/database shape)
|
||||
- Switch: `[[ ]]` (double brackets)
|
||||
- Server: `[ ]` (rectangle)
|
||||
- Firewall: `{{ }}` (hexagon)
|
||||
- Other: `[ ]` (rectangle)
|
||||
|
||||
**Edge labels:** Show interface names on both ends (A-side - B-side)
|
||||
|
||||
### View: Site Overview
|
||||
|
||||
Generate a site-level view showing racks and summary counts.
|
||||
|
||||
**Data Collection:**
|
||||
1. Use `dcim_get_site` to get site details
|
||||
2. Use `dcim_list_racks` with `site_id` filter
|
||||
3. Use `dcim_list_devices` with `site_id` filter for counts per rack
|
||||
|
||||
**Mermaid Output:**
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph site["Site: Headquarters"]
|
||||
subgraph row1["Row 1"]
|
||||
rack1["Rack A1<br/>12/42 U used<br/>5 devices"]
|
||||
rack2["Rack A2<br/>20/42 U used<br/>8 devices"]
|
||||
end
|
||||
subgraph row2["Row 2"]
|
||||
rack3["Rack B1<br/>8/42 U used<br/>3 devices"]
|
||||
end
|
||||
end
|
||||
```
|
||||
|
||||
### View: Full Infrastructure
|
||||
|
||||
Generate a high-level view of all sites and their relationships.
|
||||
|
||||
**Data Collection:**
|
||||
1. Use `dcim_list_regions` to get hierarchy
|
||||
2. Use `dcim_list_sites` to get all sites
|
||||
3. Use `dcim_list_devices` with status filter for counts
|
||||
|
||||
**Mermaid Output:**
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph region1["Region: Americas"]
|
||||
site1["Headquarters<br/>3 racks, 25 devices"]
|
||||
site2["Branch Office<br/>1 rack, 5 devices"]
|
||||
end
|
||||
subgraph region2["Region: Europe"]
|
||||
site3["EU Datacenter<br/>10 racks, 100 devices"]
|
||||
end
|
||||
|
||||
site1 -.->|"WAN Link"| site3
|
||||
```
|
||||
|
||||
### Output Format
|
||||
|
||||
Always provide:
|
||||
|
||||
1. **Summary** - Brief description of what the diagram shows
|
||||
2. **Mermaid Code Block** - The diagram code in a fenced code block
|
||||
3. **Legend** - Explanation of shapes and colors used
|
||||
4. **Data Notes** - Any data quality issues (e.g., devices without position, missing cables)
|
||||
|
||||
**Example Output:**
|
||||
|
||||
```markdown
|
||||
## Network Topology: Home Site
|
||||
|
||||
This diagram shows the network connections between 4 devices at the Home site.
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
router1[("core-router<br/>Router")]
|
||||
switch1[["main-switch<br/>Switch"]]
|
||||
server1["homelab-01<br/>Server"]
|
||||
|
||||
router1 -->|"eth0 - gi0/24"| switch1
|
||||
switch1 -->|"gi0/1 - eth0"| server1
|
||||
```
|
||||
|
||||
**Legend:**
|
||||
- Cylinder shape: Routers
|
||||
- Double brackets: Switches
|
||||
- Rectangle: Servers
|
||||
|
||||
**Data Notes:**
|
||||
- 1 device (nas-01) has no cable connections documented
|
||||
```
|
||||
|
||||
## Examples
|
||||
|
||||
- `/cmdb-topology rack server-rack-01` - Show devices in server-rack-01
|
||||
- `/cmdb-topology network` - Show all network connections
|
||||
- `/cmdb-topology network Home` - Show network topology for Home site only
|
||||
- `/cmdb-topology site Headquarters` - Show rack overview for Headquarters
|
||||
- `/cmdb-topology full` - Show full infrastructure overview
|
||||
|
||||
## User Request
|
||||
|
||||
$ARGUMENTS
|
||||
226
plugins/cmdb-assistant/commands/ip-conflicts.md
Normal file
226
plugins/cmdb-assistant/commands/ip-conflicts.md
Normal file
@@ -0,0 +1,226 @@
|
||||
---
|
||||
description: Detect IP address conflicts and overlapping prefixes in NetBox
|
||||
---
|
||||
|
||||
# CMDB IP Conflict Detection
|
||||
|
||||
Scan NetBox IPAM data to identify IP address conflicts and overlapping prefixes.
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
/ip-conflicts [scope]
|
||||
```
|
||||
|
||||
**Scopes:**
|
||||
- `all` (default) - Full scan of all IP data
|
||||
- `addresses` - Check for duplicate IP addresses only
|
||||
- `prefixes` - Check for overlapping prefixes only
|
||||
- `vrf <name>` - Scan specific VRF only
|
||||
- `prefix <cidr>` - Scan within specific prefix
|
||||
|
||||
## Instructions
|
||||
|
||||
You are an IP conflict detection specialist that analyzes NetBox IPAM data for conflicts and issues.
|
||||
|
||||
### Conflict Types to Detect
|
||||
|
||||
#### 1. Duplicate IP Addresses
|
||||
|
||||
Multiple IP address records with the same address (within same VRF).
|
||||
|
||||
**Detection:**
|
||||
1. Use `ipam_list_ip_addresses` to get all addresses
|
||||
2. Group by address + VRF combination
|
||||
3. Flag groups with more than one record
|
||||
|
||||
**Exception:** Anycast addresses may legitimately appear multiple times - check the `role` field for "anycast".
|
||||
|
||||
#### 2. Overlapping Prefixes
|
||||
|
||||
Prefixes that contain the same address space (within same VRF).
|
||||
|
||||
**Detection:**
|
||||
1. Use `ipam_list_prefixes` to get all prefixes
|
||||
2. For each prefix pair in the same VRF, check if one contains the other
|
||||
3. Legitimate hierarchies should have proper parent-child relationships
|
||||
|
||||
**Legitimate Overlaps:**
|
||||
- Parent/child prefix hierarchy (e.g., 10.0.0.0/8 contains 10.0.1.0/24)
|
||||
- Different VRFs (isolated routing tables)
|
||||
- Marked as "container" status
|
||||
|
||||
#### 3. IPs Outside Their Prefix
|
||||
|
||||
IP addresses that don't fall within any defined prefix.
|
||||
|
||||
**Detection:**
|
||||
1. For each IP address, find the most specific prefix that contains it
|
||||
2. Flag IPs with no matching prefix
|
||||
|
||||
#### 4. Prefix Overlap Across VRFs (Informational)
|
||||
|
||||
Same prefix appearing in multiple VRFs - not necessarily a conflict, but worth noting.
|
||||
|
||||
### MCP Tools
|
||||
|
||||
- `ipam_list_ip_addresses` - Get all IP addresses with filters:
|
||||
- `address` - Filter by specific address
|
||||
- `vrf_id` - Filter by VRF
|
||||
- `parent` - Filter by parent prefix
|
||||
- `status` - Filter by status
|
||||
|
||||
- `ipam_list_prefixes` - Get all prefixes with filters:
|
||||
- `prefix` - Filter by prefix CIDR
|
||||
- `vrf_id` - Filter by VRF
|
||||
- `within` - Find prefixes within a parent
|
||||
- `contains` - Find prefixes containing an address
|
||||
|
||||
- `ipam_list_vrfs` - List VRFs for context
|
||||
- `ipam_get_ip_address` - Get detailed IP info including assigned device/interface
|
||||
- `ipam_get_prefix` - Get detailed prefix info
|
||||
|
||||
### Workflow
|
||||
|
||||
1. **Data Collection**
|
||||
- Fetch all IP addresses (or filtered set)
|
||||
- Fetch all prefixes (or filtered set)
|
||||
- Fetch VRFs for context
|
||||
|
||||
2. **Duplicate Detection**
|
||||
- Build address map: `{address+vrf: [records]}`
|
||||
- Filter for entries with >1 record
|
||||
|
||||
3. **Overlap Detection**
|
||||
- For each VRF, compare prefixes pairwise
|
||||
- Check using CIDR math: does prefix A contain prefix B or vice versa?
|
||||
- Ignore legitimate hierarchies (status=container)
|
||||
|
||||
4. **Orphan IP Detection**
|
||||
- For each IP, find containing prefix
|
||||
- Flag IPs with no prefix match
|
||||
|
||||
5. **Generate Report**
|
||||
|
||||
### Report Format
|
||||
|
||||
```markdown
|
||||
## IP Conflict Detection Report
|
||||
|
||||
**Generated:** [timestamp]
|
||||
**Scope:** [scope parameter]
|
||||
|
||||
### Summary
|
||||
|
||||
| Check | Status | Count |
|
||||
|-------|--------|-------|
|
||||
| Duplicate IPs | [PASS/FAIL] | X |
|
||||
| Overlapping Prefixes | [PASS/FAIL] | Y |
|
||||
| Orphan IPs | [PASS/FAIL] | Z |
|
||||
| Total Issues | - | N |
|
||||
|
||||
### Critical Issues
|
||||
|
||||
#### Duplicate IP Addresses
|
||||
|
||||
| Address | VRF | Count | Assigned To |
|
||||
|---------|-----|-------|-------------|
|
||||
| 10.0.1.50/24 | Global | 2 | server-01 (eth0), server-02 (eth0) |
|
||||
| 192.168.1.100/24 | Global | 2 | router-01 (gi0/1), switch-01 (vlan10) |
|
||||
|
||||
**Impact:** IP conflicts cause network connectivity issues. Devices will have intermittent connectivity.
|
||||
|
||||
**Resolution:**
|
||||
- Determine which device should have the IP
|
||||
- Update or remove the duplicate assignment
|
||||
- Consider IP reservation to prevent future conflicts
|
||||
|
||||
#### Overlapping Prefixes
|
||||
|
||||
| Prefix 1 | Prefix 2 | VRF | Type |
|
||||
|----------|----------|-----|------|
|
||||
| 10.0.0.0/24 | 10.0.0.0/25 | Global | Unstructured overlap |
|
||||
| 192.168.0.0/16 | 192.168.1.0/24 | Production | Missing container flag |
|
||||
|
||||
**Impact:** Overlapping prefixes can cause routing ambiguity and IP management confusion.
|
||||
|
||||
**Resolution:**
|
||||
- For legitimate hierarchies: Mark parent prefix as status="container"
|
||||
- For accidental overlaps: Consolidate or re-address one prefix
|
||||
|
||||
### Warnings
|
||||
|
||||
#### IPs Without Prefix
|
||||
|
||||
| Address | VRF | Assigned To | Nearest Prefix |
|
||||
|---------|-----|-------------|----------------|
|
||||
| 172.16.5.10/24 | Global | server-03 (eth0) | None found |
|
||||
|
||||
**Impact:** IPs without a prefix bypass IPAM allocation controls.
|
||||
|
||||
**Resolution:**
|
||||
- Create appropriate prefix to contain the IP
|
||||
- Or update IP to correct address within existing prefix
|
||||
|
||||
### Informational
|
||||
|
||||
#### Same Prefix in Multiple VRFs
|
||||
|
||||
| Prefix | VRFs | Purpose |
|
||||
|--------|------|---------|
|
||||
| 10.0.0.0/24 | Global, DMZ, Internal | [Check if intentional] |
|
||||
|
||||
### Statistics
|
||||
|
||||
| Metric | Value |
|
||||
|--------|-------|
|
||||
| Total IP Addresses | X |
|
||||
| Total Prefixes | Y |
|
||||
| Total VRFs | Z |
|
||||
| Utilization (IPs/Prefix space) | W% |
|
||||
|
||||
### Remediation Commands
|
||||
|
||||
```
|
||||
# Remove duplicate IP (keep server-01's assignment)
|
||||
ipam_delete_ip_address id=123
|
||||
|
||||
# Mark prefix as container
|
||||
ipam_update_prefix id=456 status=container
|
||||
|
||||
# Create missing prefix for orphan IP
|
||||
ipam_create_prefix prefix=172.16.5.0/24 status=active
|
||||
```
|
||||
```
|
||||
|
||||
### CIDR Math Reference
|
||||
|
||||
For overlap detection, use these rules:
|
||||
- Prefix A **contains** Prefix B if: A.network <= B.network AND A.broadcast >= B.broadcast
|
||||
- Two prefixes **overlap** if: A.network <= B.broadcast AND B.network <= A.broadcast
|
||||
|
||||
**Example:**
|
||||
- 10.0.0.0/8 contains 10.0.1.0/24 (legitimate hierarchy)
|
||||
- 10.0.0.0/24 and 10.0.0.128/25 overlap (10.0.0.128/25 is within 10.0.0.0/24)
|
||||
|
||||
### Severity Levels
|
||||
|
||||
| Issue | Severity | Description |
|
||||
|-------|----------|-------------|
|
||||
| Duplicate IP (same interface type) | CRITICAL | Active conflict, causes outages |
|
||||
| Duplicate IP (different roles) | HIGH | Potential conflict |
|
||||
| Overlapping prefixes (same status) | HIGH | IPAM management issue |
|
||||
| Overlapping prefixes (container ok) | LOW | May need status update |
|
||||
| Orphan IP | MEDIUM | Bypasses IPAM controls |
|
||||
|
||||
## Examples
|
||||
|
||||
- `/ip-conflicts` - Full scan for all conflicts
|
||||
- `/ip-conflicts addresses` - Check only for duplicate IPs
|
||||
- `/ip-conflicts prefixes` - Check only for overlapping prefixes
|
||||
- `/ip-conflicts vrf Production` - Scan only Production VRF
|
||||
- `/ip-conflicts prefix 10.0.0.0/8` - Scan within specific prefix range
|
||||
|
||||
## User Request
|
||||
|
||||
$ARGUMENTS
|
||||
Reference in New Issue
Block a user