Started v2.4 documentation refresh

docs/core-functionality/circuits.md

@@ -0,0 +1,34 @@
+# Providers
+
+A provider is any entity which provides some form of connectivity. While this obviously includes carriers which offer Internet and private transit service, it might also include Internet exchange (IX) points and even organizations with whom you peer directly.
+
+Each provider may be assigned an autonomous system number (ASN), an account number, and relevant contact information.
+
+---
+
+# Circuits
+
+A circuit represents a single _physical_ link connecting exactly two endpoints. (A circuit with more than two endpoints is a virtual circuit, which is not currently supported by NetBox.) Each circuit belongs to a provider and must be assigned a circuit ID which is unique to that provider.
+
+## Circuit Types
+
+Circuits are classified by type. For example, you might define circuit types for:
+
+* Internet transit
+* Out-of-band connectivity
+* Peering
+* Private backhaul
+
+Circuit types are fully customizable.
+
+## Circuit Terminations
+
+A circuit may have one or two terminations, annotated as the "A" and "Z" sides of the circuit. A single-termination circuit can be used when you don't know (or care) about the far end of a circuit (for example, an Internet access circuit which connects to a transit provider). A dual-termination circuit is useful for tracking circuits which connect two sites.
+
+Each circuit termination is tied to a site, and optionally to a specific device and interface within that site. Each termination can be assigned a separate downstream and upstream speed independent from one another. Fields are also available to track cross-connect and patch panel details.
+
+!!! note
+    A circuit represents a physical link, and cannot have more than two endpoints. When modeling a multi-point topology, each leg of the topology must be defined as a discrete circuit.
+
+!!! note
+    A circuit may terminate only to a physical interface. Circuits may not terminate to LAG interfaces, which are virtual interfaces: You must define each physical circuit within a service bundle separately and terminate it to its actual physical interface.

docs/core-functionality/devices.md

@@ -0,0 +1,120 @@
+# Device Types
+
+A device type represents a particular make and model of hardware that exists in the real world. Device types define the physical attributes of a device (rack height and depth) and its individual components (console, power, and network interfaces).
+
+Device types are instantiated as devices installed within racks. For example, you might define a device type to represent a Juniper EX4300-48T network switch with 48 Ethernet interfaces. You can then create multiple devices of this type named "switch1," "switch2," and so on. Each device will inherit the components (such as interfaces) of its device type at the time of creation. (However, changes made to a device type will **not** apply to instances of that device type retroactively.)
+
+The device type model includes three flags which inform what type of components may be added to it:
+
+* `is_console_server`: This device type has console server ports
+* `is_pdu`: This device type has power outlets
+* `is_network_device`: This device type has network interfaces
+
+Some devices house child devices which share physical resources, like space and power, but which functional independently from one another. A common example of this is blade server chassis. Each device type is designated as one of the following:
+
+* A parent device (which has device bays)
+* A child device (which must be installed in a device bay)
+* Neither
+
+!!! note
+    This parent/child relationship is **not** suitable for modeling chassis-based devices, wherein child members share a common control plane.
+
+## Manufacturers
+
+Each device type must be assigned to a manufacturer. The model number of a device type must be unique to its manufacturer.
+
+## Component Templates
+
+Each device type is assigned a number of component templates which define the physical components within a device. These are:
+
+* Console ports
+* Console server ports
+* Power ports
+* Power outlets
+* Network interfaces
+* Device bays (which house child devices)
+
+Whenever a new device is created, its components are automatically created per the templates assigned to its device type. For example, a Juniper EX4300-48T device type might have the following component templates defined:
+
+* One template for a console port ("Console")
+* Two templates for power ports ("PSU0" and "PSU1")
+* 48 templates for 1GE interfaces ("ge-0/0/0" through "ge-0/0/47")
+* Four templates for 10GE interfaces ("xe-0/2/0" through "xe-0/2/3")
+
+Once component templates have been created, every new device that you create as an instance of this type will automatically be assigned each of the components listed above.
+
+!!! note
+    Assignment of components from templates occurs only at the time of device creation. If you modify the templates of a device type, it will not affect devices which have already been created. However, you always have the option of adding, modifying, or deleting components on existing devices.
+
+---
+
+# Devices
+
+Every piece of hardware which is installed within a rack exists in NetBox as a device. Devices are measured in rack units (U) and can be half depth or full depth. A device may have a height of 0U: These devices do not consume vertical rack space and cannot be assigned to a particular rack unit. A common example of a 0U device is a vertically-mounted PDU.
+
+When assigning a multi-U device to a rack, it is considered to be mounted in the lowest-numbered rack unit which it occupies. For example, a 3U device which occupies U8 through U10 is said to be mounted in U8. This logic applies to racks with both ascending and descending unit numbering.
+
+A device is said to be full depth if its installation on one rack face prevents the installation of any other device on the opposite face within the same rack unit(s). This could be either because the device is physically too deep to allow a device behind it, or because the installation of an opposing device would impede airflow.
+
+## Device Roles
+
+Devices can be organized by functional roles. These roles are fully cusomizable. For example, you might create roles for core switches, distribution switches, and access switches.
+
+---
+
+# Device Components
+
+There are six types of device components which comprise all of the interconnection logic with NetBox:
+
+* Console ports
+* Console server ports
+* Power ports
+* Power outlets
+* Network interfaces
+* Device bays
+
+## Console
+
+Console ports connect only to console server ports. Console connections can be marked as either *planned* or *connected*.
+
+## Power
+
+Power ports connect only to power outlets. Power connections can be marked as either *planned* or *connected*.
+
+## Interfaces
+
+Interfaces connect to one another in a symmetric manner: If interface A connects to interface B, interface B therefore connects to interface A. Each type of connection can be classified as either *planned* or *connected*.
+
+Each interface is a assigned a form factor denoting its physical properties. Two special form factors exist: the "virtual" form factor can be used to designate logical interfaces (such as SVIs), and the "LAG" form factor can be used to desinate link aggregation groups to which physical interfaces can be assigned.
+
+Each interface can also be enabled or disabled, and optionally designated as management-only (for out-of-band management). Fields are also provided to store an interface's MTU and MAC address.
+
+VLANs can be assigned to each interface as either tagged or untagged. (An interface may have only one untagged VLAN.)
+
+## Device Bays
+
+Device bays represent the ability of a device to house child devices. For example, you might install four blade servers into a 2U chassis. The chassis would appear in the rack elevation as a 2U device with four device bays. Each server within it would be defined as a 0U device installed in one of the device bays. Child devices do not appear within rack elevations, but they are included in the "Non-Racked Devices" list within the rack view.
+
+---
+
+# Platforms
+
+A platform defines the type of software running on a device or virtual machine. This can be helpful when it is necessary to distinguish between, for instance, different feature sets. Note that two devices of same type may be assigned different platforms: for example, one Juniper MX240 running Junos 14 and another running Junos 15.
+
+The platform model is also used to indicate which [NAPALM](https://napalm-automation.net/) driver NetBox should use when connecting to a remote device. The name of the driver along with optional parameters are stored with the platform. See the [API documentation](api/napalm-integration.md) for more information on NAPALM integration.
+
+The assignment of platforms to devices is an optional feature, and may be disregarded if not desired.
+
+---
+
+# Inventory Items
+
+Inventory items represent hardware components installed within a device, such as a power supply or CPU. Currently, these are used merely for inventory tracking, although future development might see their functionality expand. Like device types, each item can optionally be assigned a manufacturer.
+
+---
+
+# Virtual Chassis
+
+A virtual chassis represents a set of devices which share a single control plane: a stack of switches which are managed as a single device, for example. Each device in the virtual chassis is assigned a position and (optionally) a priority. Exactly one device is designated the virtual chassis master: This device will typically be assigned a name, secrets, services, and other attributes related to its management.
+
+It's important to recognize the distinction between a virtual chassis and a chassis-based device. For instance, a virtual chassis is not used to model a chassis switch with removable line cards such as the Juniper EX9208, as its line cards are _not_ physically separate devices capable of operating independently.

docs/core-functionality/ipam.md

@@ -0,0 +1,93 @@
+# Aggregates
+
+The first step to documenting your IP space is to define its scope by creating aggregates. Aggregates establish the root of your IP address hierarchy by defining the top-level allocations that you're interested in managing. Most organizations will want to track some commonly-used private IP spaces, such as:
+
+* 10.0.0.0/8 (RFC 1918)
+* 100.64.0.0/10 (RFC 6598)
+* 172.16.0.0/20 (RFC 1918)
+* 192.168.0.0/16 (RFC 1918)
+* One or more /48s within fd00::/8 (IPv6 unique local addressing)
+
+In addition to one or more of these, you'll want to create an aggregate for each globally-routable space your organization has been allocated. These aggregates should match the allocations recorded in public WHOIS databases.
+
+Each IP prefix will be automatically arranged under its parent aggregate if one exists. Note that it's advised to create aggregates only for IP ranges actually allocated to your organization (or marked for private use): There is no need to define aggregates for provider-assigned space which is only used on Internet circuits, for example.
+
+Aggregates cannot overlap with one another: They can only exist side-by-side. For instance, you cannot define both 10.0.0.0/8 and 10.16.0.0/16 as aggregates, because they overlap. 10.16.0.0/16 in this example would be created as a prefix and automatically grouped under 10.0.0.0/8. Remember, the purpose of aggregates is to establish the root of your IP addressing hierarchy.
+
+## Regional Internet Registries (RIRs)
+
+[Regional Internet registries](https://en.wikipedia.org/wiki/Regional_Internet_registry) are responsible for the allocation of globally-routable address space. The five RIRs are ARIN, RIPE, APNIC, LACNIC, and AFRINIC. However, some address space has been set aside for internal use, such as defined in RFCs 1918 and 6598. NetBox considers these RFCs as a sort of RIR as well; that is, an authority which "owns" certain address space. There also exist lower-tier registries which serve a particular geographic area.
+
+Each aggregate must be assigned to one RIR. You are free to define whichever RIRs you choose (or create your own). The RIR model includes a boolean flag which indicates whether the RIR allocates only private IP space.
+
+For example, suppose your organization has been allocated 104.131.0.0/16 by ARIN. It also makes use of RFC 1918 addressing internally. You would first create RIRs named ARIN and RFC 1918, then create an aggregate for each of these top-level prefixes, assigning it to its respective RIR.
+
+---
+
+# Prefixes
+
+A prefix is an IPv4 or IPv6 network and mask expressed in CIDR notation (e.g. 192.0.2.0/24). A prefix entails only the "network portion" of an IP address: All bits in the address not covered by the mask must be zero. (In other words, a prefix cannot be a specific IP address.)
+
+Prefixes are automatically arranged by their parent aggregates. Additionally, each prefix can be assigned to a particular site and VRF (routing table). All prefixes not assigned to a VRF will appear in the "global" table.
+
+Each prefix can be assigned a status and a role. These terms are often used interchangeably so it's important to recognize the difference between them. The **status** defines a prefix's operational state. Statuses are hard-coded in NetBox and can be one of the following:
+
+* Container - A summary of child prefixes
+* Active - Provisioned and in use
+* Reserved - Designated for future use
+* Deprecated - No longer in use
+
+On the other hand, a prefix's **role** defines its function. Role assignment is optional and roles are fully customizable. For example, you might create roles to differentiate between production and development infrastructure.
+
+A prefix may also be assigned to a VLAN. This association is helpful for identifying which prefixes are included when reviewing a list of VLANs.
+
+The prefix model include a "pool" flag. If enabled, NetBox will treat this prefix as a range (such as a NAT pool) wherein every IP address is valid and assignable. This logic is used for identifying available IP addresses within a prefix. If this flag is disabled, NetBox will assume that the first and last (broadcast) address within the prefix are unusable.
+
+---
+
+# IP Addresses
+
+An IP address comprises a single host address (either IPv4 or IPv6) and its subnet mask. Its mask should match exactly how the IP address is configured on an interface in the real world.
+
+Like prefixes, an IP address can optionally be assigned to a VRF (otherwise, it will appear in the "global" table). IP addresses are automatically organized under parent prefixes within their respective VRFs.
+
+Also like prefixes, each IP address can be assigned a status and a role. Statuses are hard-coded in NetBox and include the following:
+
+* Active
+* Reserved
+* Deprecated
+* DHCP
+
+IP address roles are also hard-coded, and can be used to indicate a special condition of the IP address. Role assignment is optional. Available roles include:
+
+* Loopback
+* Secondary
+* Anycast
+* VIP
+* VRRP
+* HSRP
+* GLBP
+
+An IP address can be assigned to a device or virtual machine interface, and an interface may have multiple IP addresses assigned to it. Further, each device and virtual machine may have one of its interface IPs designated as its primary IP address (one for IPv4 and one for IPv6).
+
+## Network Address Translation (NAT)
+
+An IP address can be designated as the network address translation (NAT) inside IP address for exactly one other IP address. This is useful primarily to denote a translation between public and private IP addresses. This relationship is followed in both directions: For example, if 10.0.0.1 is assigned as the inside IP for 192.0.2.1, 192.0.2.1 will be displayed as the outside IP for 10.0.0.1.
+
+!!! note
+    NetBox does not support tracking one-to-many NAT relationships (also called port address translation). This type of policy requires additional logic to model and cannot be fully represented by IP address alone.
+
+---
+
+# Virtual Routing and Forwarding (VRF)
+
+A VRF object in NetBox represents a virtual routing and forwarding (VRF) domain. Each VRF is essentially a separate routing table. VRFs are commonly used to isolate customers or organizations from one another within a network, or to route overlapping address space (e.g. multiple instances of the 10.0.0.0/8 space).
+
+Each VRF is assigned a unique name and route distinguisher (RD). The RD is expected to take one of the forms prescribed in [RFC 4364](https://tools.ietf.org/html/rfc4364#section-4.2), however its formatting is not strictly enforced.
+
+Each prefix and IP address may be assigned to one (and only one) VRF. If you have a prefix or IP address which exists in multiple VRFs, you will need to create a separate instance of it in NetBox for each VRF. Any IP prefix or address not assigned to a VRF is said to belong to the "global" table.
+
+By default, NetBox will allow duplicate prefixes to be assigned to a VRF. This behavior can be disabled by setting the "enforce unique" flag on the VRF model.
+
+!!! note
+    Enforcement of unique IP space can be toggled for global table (non-VRF prefixes) using the `ENFORCE_GLOBAL_UNIQUE` configuration setting.

docs/core-functionality/secrets.md

@@ -0,0 +1,41 @@
+# Secrets
+
+A secret represents a single credential or other sensitive string of characters which must be stored securely. Each secret is assigned to a device within NetBox. The plaintext value of a secret is encrypted to a ciphertext immediately prior to storage within the database using a 256-bit AES master key. A SHA256 hash of the plaintext is also stored along with each ciphertext to validate the decrypted plaintext.
+
+Each secret can also store an optional name parameter, which is not encrypted. This may be useful for storing user names.
+
+## Roles
+
+Each secret is assigned a functional role which indicates what it is used for. Secret roles are customizable. Typical roles might include:
+
+* Login credentials
+* SNMP community strings
+* RADIUS/TACACS+ keys
+* IKE key strings
+* Routing protocol shared secrets
+
+Roles are also used to control access to secrets. Each role is assigned an arbitrary number of groups and/or users. Only the users associated with a role have permission to decrypt the secrets assigned to that role. (A superuser has permission to decrypt all secrets, provided they have an active user key.)
+
+---
+
+# User Keys
+
+Each user within NetBox can associate his or her account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted copy of the AES master key needed to retrieve secret data.
+
+User keys may be created by users individually, however they are of no use until they have been activated by a user who already possesses an active user key.
+
+## Creating the First User Key
+
+When NetBox is first installed, it contains no encryption keys. Before it can store secrets, a user (typically the superuser) must create a user key. This can be done by navigating to Profile > User Key.
+
+To create a user key, you can either generate a new RSA key pair, or upload the public key belonging to a pair you already have. If generating a new key pair, **you must save the private key** locally before saving your new user key. Once your user key has been created, its public key will be displayed under your profile.
+
+When the first user key is created in NetBox, a random master encryption key is generated automatically. This key is then encrypted using the public key provided and stored as part of your user key. **The master key cannot be recovered** without your private key.
+
+Once a user key has been assigned an encrypted copy of the master key, it is considered activated and can now be used to encrypt and decrypt secrets.
+
+## Creating Additional User Keys
+
+Any user can create his or her user key by generating or uploading a public RSA key. However, a user key cannot be used to encrypt or decrypt secrets until it has been activated with an encrypted copy of the master key.
+
+Only an administrator with an active user key can activate other user keys. To do so, access the NetBox admin UI and navigate to Secrets > User Keys. Select the user key(s) to be activated, and select "activate selected user keys" from the actions dropdown. You will need to provide your private key in order to decrypt the master key. A copy of the master key is then encrypted using the public key associated with the user key being activated.

docs/core-functionality/services.md

@@ -0,0 +1,5 @@
+# Services
+
+A service represents a layer four TCP or UDP service available on a device or virtual machine. Each service includes a name, protocol, and port number; for example, "SSH (TCP/22)" or "DNS (UDP/53)."
+
+A service may optionally be bound to one or more specific IP addresses belonging to its parent device or VM. (If no IP addresses are bound, the service is assumed to be reachable via any assigned IP address.)

docs/core-functionality/sites-and-racks.md

@@ -0,0 +1,49 @@
+# Sites
+
+How you choose to use sites will depend on the nature of your organization, but typically a site will equate to a building or campus. For example, a chain of banks might create a site to represent each of its branches, a site for its corporate headquarters, and two additional sites for its presence in two colocation facilities.
+
+Each site must be assigned one of the following operational statuses:
+
+* Active
+* Planned
+* Retired
+
+The site model provides a facility ID field which can be used to annotate a facility ID (such as a datacenter name) associated with the site. Each site may also have an autonomous system (AS) number and time zone associated with it. (Time zones are provided by the [pytz](https://pypi.org/project/pytz/) package.)
+
+The site model also includes several fields for storing contact and address information.
+
+## Regions
+
+Sites can be arranged geographically using regions. A region might represent a continent, country, city, campus, or other area depending on your use case. Regions can be nested recursively to construct a hierarchy. For example, you might define several country regions, and within each of those several state or city regions to which sites are assigned.
+
+---
+
+# Racks
+
+The rack model represents a physical two- or four-post equipment rack in which equipment is mounted. Each rack must be assigned to a site. Rack height is measured in *rack units* (U); racks are commonly between 42U and 48U tall, but NetBox allows you to define racks of arbitrary height. A toggle is provided to indicate whether rack units are in ascending or descending order.
+
+Each rack is assigned a name and (optionally) a separate facility ID. This is helpful when leasing space in a data center your organization does not own: The facility will often assign a seemingly arbitrary ID to a rack (for example, "M204.313") whereas internally you refer to is simply as "R113." A unique serial number may also be associated with each rack.
+
+A rack must be designated as one of the following types:
+
+* 2-post frame
+* 4-post frame
+* 4-post cabinet
+* Wall-mounted frame
+* Wall-mounted cabinet
+
+Each rack has two faces (front and rear) on which devices can be mounted. Rail-to-rail width may be 19 or 23 inches.
+
+## Rack Groups
+
+Racks can be arranged into groups. As with sites, how you choose to designate rack groups will depend on the nature of your organization. For example, if each site represents a campus, each group might represent a building within a campus. If each site represents a building, each rack group might equate to a floor or room.
+
+Each rack group must be assigned to a parent site. Hierarchical recursion of rack groups is not currently supported.
+
+## Rack Roles
+
+Each rack can optionally be assigned a functional role. For example, you might designate a rack for compute or storage resources, or to house colocated customer devices. Rack roles are fully customizable.
+
+## Rack Space Reservations
+
+Users can reserve units within a rack for future use. Multiple non-contiguous rack units can be associated with a single reservation (but reservations cannot span multiple racks). A rack reservation may optionally designate a specific tenant.

docs/core-functionality/tenancy.md

@@ -0,0 +1,20 @@
+# Tenants
+
+A tenant represents a discrete entity for administrative purposes. Typically, tenants are used to represent individual customers or internal departments within an organization. The following objects can be assigned to tenants:
+
+* Sites
+* Racks
+* Rack reservations
+* Devices
+* VRFs
+* Prefixes
+* IP addresses
+* VLANs
+* Circuits
+* Virtual machines
+
+If a prefix or IP address is not assigned to a tenant, it will appear to inherit the tenant to which its parent VRF is assigned, if any.
+
+### Tenant Groups
+
+Tenants can be organized by custom groups. For instance, you might create one group called "Customers" and one called "Acquisitions." The assignment of tenants to groups is optional.

docs/core-functionality/virtual-machines.md

@@ -0,0 +1,27 @@
+# Clusters
+
+A cluster is a logical grouping of physical resources within which virtual machines run. A cluster must be assigned a type, and may optionally be assigned to a group and/or site.
+
+Physical devices may be associated with clusters as hosts. This allows users to track on which host(s) a particular VM may reside. However, NetBox does not support pinning a specific VM within a cluster to a particular host device.
+
+## Cluster Types
+
+A cluster type represents a technology or mechanism by which a cluster is formed. For example, you might create a cluster type named "VMware vSphere" for a locally hosted cluster or "DigitalOcean NYC3" for one hosted by a cloud provider.
+
+## Cluster Groups
+
+Cluster groups may be created for the purpose of organizing clusters. The assignment of clusters to groups is optional.
+
+---
+
+# Virtual Machines
+
+A virtual machine represents a virtual compute instance hosted within a cluster. Each VM must be associated with exactly one cluster.
+
+Like devices, each VM can be assigned a platform and have interfaces created on it. VM interfaces behave similarly to device interfaces, and can be assigned IP addresses, VLANs, and services. However, given their virtual nature, they cannot be connected to other interfaces. Unlike physical devices, VMs cannot be assigned console or power ports, device bays, or inventory items.
+
+The following resources can be defined for each VM:
+
+* vCPU count
+* Memory (MB)
+* Disk space (GB)

docs/core-functionality/vlans.md

@@ -0,0 +1,15 @@
+# VLANs
+
+A VLAN represents an isolated layer two domain, identified by a name and a numeric ID (1-4094) as defined in [IEEE 802.1Q](https://en.wikipedia.org/wiki/IEEE_802.1Q). Each VLAN may be assigned to a site and/or VLAN group.
+
+Each VLAN must be assigned one of the following operational statuses:
+
+* Active
+* Reserved
+* Deprecated
+
+Each VLAN may also be assigned a functional role. Prefixes and VLANs share the same set of customizable roles.
+
+## VLAN Groups
+
+VLAN groups can be used to organize VLANs within NetBox. Groups can also be used to enforce uniqueness: Each VLAN within a group must have a unique ID and name. VLANs which are not assigned to a group may have overlapping names and IDs (including VLANs which belong to a common site). For example, you can create two VLANs with ID 123, but they cannot both be assigned to the same group.