Track a Free /48 in NetBox from Claim Through Announcement

Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end.

A single /48 looks too small to need an IP address management tool. But a /48 holds 65,536 /64s, and within a year it is usually split across LANs, VPN ranges, Kubernetes clusters and service addresses at several sites. If the plan lives in someone's head or a spreadsheet, overlaps and forgotten ranges follow. NetBox is a widely used open source tool for recording this. This article tracks a free IPv6 /48 from IPYE in NetBox from the day you claim it to the day it is announced. Examples use 2001:db8:100::/48 and AS64496.

Model the source of the space

In NetBox, create:

1. An RIR entry for the registry that holds the space. Mark it as not private.
2. An Aggregate for 2001:db8:100::/48, linked to that RIR, with the date you received it. In the description, record that the space is leased and where the LOA is kept.
3. An ASN object for AS64496, linked to the same RIR.

Aggregates are the top of the tree. NetBox then shows how much of the /48 is used by the prefixes below it.

Create child prefixes before you configure anything

Make it a rule that a range exists in NetBox before it appears in any config. For example:

Mark ranges as container when they will be split further. NetBox's "available prefixes" view then shows free /64s inside a container, which makes the next allocation quick.

Use the API from the start

Creating prefixes by API means scripts and CI can do it too:

curl -s -X POST https://netbox.example.net/api/ipam/prefixes/ \ -H "Authorization: Token $NETBOX_TOKEN" \ -H "Content-Type: application/json" \ -d '{"prefix": "2001:db8:100:40::/64", "status": "active", "description": "lab LAN"}' 

Or let NetBox choose the next free /64 inside a container:

curl -s -X POST https://netbox.example.net/api/ipam/prefixes/<container-id>/available-prefixes/ \ -H "Authorization: Token $NETBOX_TOKEN" \ -H "Content-Type: application/json" \ -d '{"prefix_length": 64, "description": "new VLAN"}' 

The pynetbox library wraps the same API for Python scripts. Keep the token in a secret store, not in shell history.

Record the routing facts

Store the facts other people need during an incident:

• the BGP session details: upstream ASN, neighbour address, location
• where the LOA is stored and when it was issued
• the ROA status and maxLength
• the IRR as-set name

Recent NetBox versions support custom fields on any object, so you can add fields such as loa_issued and roa_maxlength to the aggregate. For BGP sessions, the netbox-bgp plugin adds a proper session model.

Lifecycle states

Use statuses deliberately:

• reserved when you have planned a range but nothing uses it yet
• active when it is configured and in use
• deprecated when you are moving things out

Never delete a prefix the same day you stop using it. Mark it deprecated, check for traffic, then remove it.

Catch drift

NetBox is only useful if it matches reality. A simple drift check compares addresses on your hosts and routers with what NetBox has:

ip -j -6 addr show scope global | jq -r '.[].addr_info[].local' 

Feed that into a script that queries /api/ipam/ip-addresses/?address=... and reports any address NetBox does not know. Run it nightly and send differences to a chat channel, or fail a CI job when a config change uses a range missing from NetBox.

Generate config from NetBox

Once NetBox is trusted, generate the BGP outbound prefix-list from the aggregate rather than typing it. Then an export filter cannot drift from your records. The same goes for firewall sets and DNS zones.

Paperwork

When the prefix moves to a new host, download a new LOA from the IPYE portal and update the aggregate's custom fields the same day.

Do this next

Claim a free /48 from IPYE, create the aggregate in NetBox first, and allocate every range through it. Questions: ipye@turnel.com.

About IPYE

IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: ipye@turnel.com.

Disclosure: I run IPYE