Skip to main content
Flexible Top Header

Discuss BlueCat products

Find a dedicated community space for any BlueCat product you use. Find answers, start conversations, help others and get to know your fellow product users.

31 Topics
D
dittmanAuthenticated Nodes
asked in Integrity
Let's Encrypt Certs in 25.1 vs. 9.6.1

I’ve upgraded my lab to 25.1 and have found that the Let’s Encrypt certs aren’t working as expected.  I don’t see errors in Firefox or Chrome but code to check the certs are failing against 25.1 with the error “ Certificate validation error: FQDN-25.1 [unable to get local issuer certificate]” which lead me to test with curl.I’m wondering if anyone else is seeing the same issue or is this something I’m doing wrong.This is the error I see with “curl -v https://FQDN/”:root@bam:~# curl -v https://FQDN/* Trying 10.0.10.26:443...* Connected to FQDN (10.0.10.26) port 443 (#0)* ALPN: offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):* TLSv1.3 (IN), TLS handshake, Certificate (11):* TLSv1.3 (OUT), TLS alert, unknown CA (560):* SSL certificate problem: unable to get local issuer certificate* Closing connec

4713
D
massodec
massodecProvisioned Rookie
asked in Integrity
replicate in API v2 the behaviour of 'excludeDHCPRange=false' from v1 API

Hello,We are migrating our "legacy" v1 API scripts for BAM 9.6.1 to v2 API.In one of those tools, we use v1 "POST /Services/REST/v1/assignNextAvailableIP4Address" to look for a free static IP address. This endpoint provides parameter 'excludeDHCPRange=false' to easily avoid assigning static IP addresses from DHCP Ranges.To achieve the same outcome in v2 API, we should use v2 "POST /api/v2/networks/{collectionId}/addresses" with the 'x-bcn-excluded-addresses' header.But that header is not a Boolean but a list of IPRanges.We're thinking on populating that 'x-bcn-excluded-addresses' header with the output of another API call to "GET /api/v2/networks/{collectionId}/ranges".But even this approach is pretty straight-forward, it feels we are over complicating the process.Are we missing something? Is there any easier way to achieve in v2 API the same behaviour from v1 'excludeDHCPRange=false' ?Thank you very much.

252
massodec
moni.veronese
moni.veroneseCommunity Manager
posted in Integrity
Notes from the Integrity X community discussion posted in the group

Posting here for anybody subscribed to the Integrity channel The notes have been posted in the Layer 8 Lounge Group: Join the Layer 8 Lounge group to keep up to date with ​​​future events and notes from the calls👉 https://community.bluecatnetworks.com/groups/layer-8-lounge-43

60
moni.veronese
moni.veronese
moni.veroneseCommunity Manager
published in Integrity
Integrity X Videos: RESTful API Automation, New UI, Metrics & Visualization and TaggingTutorial

New Integrity X Videos We’ve published 4 new videos to walk you through some of whats new in Integrity X.Each video covers a different theme:  Automation with RESTful APIs New UI  Tagging  Metrics and Visualization A new UI, built for the way you work  Integrity X introduces a fully modern, accessible, and intuitive interface — purpose-built to empower every user. Whether you’re provisioning DHCP, managing IP space, or investigating DNS issues, the UI puts the power of the platform at your fingertips without the noise or clutter. Designed for speed, optimized for clarity, and compliant with WCAG 2.2 AA — it’s a UI every team can work with confidence.Watch the 2-minute UI walkthrough Automation-first. API-Powered.If you can do it in the UI, you can automate it. Integrity X is built entirely on a RESTful API, which also powers the product itself. Use the UI to bootstrap API calls, explore parameters via OpenAPI spec, and even kickstart AI-assisted provisioning. Whether you're build

310
moni.veronese
christopher.nielsen
christopher.nielsenNetwork VIP Newbie
asked in Integrity
V2 API create wildcard host record via address API /api/v2/networks/{collection-id}/addresses

I’m attempting to do a POST to /api/v2/networks/{collection-id}/addresses to grab an IP address and put a DNS name on it. This is working find except when I attempt to add a wildcard DNS entry like the following:{    "name": "*.example.net",                             ← This puts a name on the IPv4 address object    "type": "IPv4Address",    "state": "STATIC",    "userDefinedFields": {        "mnemonic": "OCP"    },    "resourceRecords": [        {            "type": "HostRecord",            "absoluteName": "*.example.net",               ← This should put a host record into the example.net zone            "views": [                {                    "id": "93864"                }            ],            "userDefinedFields": {                "mnemonic": "OCP"            }        }    ]}  {    "status": 400,    "reason": "Bad Request",    "code": "InvalidFullyQualifiedDomainName",    "message": "The value for resource field 'resourceRecords[0].absoluteName' is not a valid fully quali

272
christopher.nielsen
moni.veronese
moni.veroneseCommunity Manager
published in Integrity
Introducing BlueCat Integrity X
Introducing BlueCat Integrity XNew Release

We are thrilled to unveil the latest updates in our product lineup: BlueCat Integrity X, 25.1. This release represents a transformative step forward in our DNS, DHCP, and IP address management solutions. It empowers IT teams seeking a single platform for complete visibility and control over critical network services.What’s new with Integrity X?At BlueCat, we are committed to creating a unified, intuitive DDI management platform built for the future. Integrity X represents a monumental leap forward in our DDI partnership with customers: it is an innovative release that highlights our unwavering commitment to developing resilient and future-proof solutions that scaleWe’re not just here to help complete manual DDI tasks; we’re here to ignite a visionary transformation, enabling our customers to reimagine how they accomplish work with remarkable speed and efficiency using automation. We’re proud to deliver a release that provides a UI/UX that bridges the gap between manual DDI management a

1143
moni.veronese
T
tmaestasActive Endpoint
posted in Integrity
Integrity GSSTSIG support

Since ISC has announced the deprecation of the tkey-gssapi-credential and tkey-domain configuration statements in BIND, both of which are used by Integrity’s current GSSTSIG implementation, can we PLEASE use the refactoring opportunity to get better support for multi-realm GSSTSIG and keytab management?  We currently have to use postDeploy.sh scripting to get the resulting configuration that we want (jettisoning the BAM-generated single-realm keytab and substituting our own, commenting out the BAM-generated tkey-gssapi-credential and tkey-domain statements, and substituting a tkey-gssapi-keytab statement). Ideally BAM should either A) natively support generating a keytab that contains the needed principals and referencing it via the tkey-gssapi-keytab configuration statement (which is ISC’s go-forward requirement) or B) allow the user to import their own keytab and reference that (as other competing products do).I’m sure I have a feature-request for multi-realm support floating around

100
T
rharolde
rharoldeDNS/DHCP/IPAM at U of Michigan
posted in Integrity
UDL - User Defined Link

I would be interested in how people are using UDLs in real life.  I have not used them yet, but it seems like I probably should somewhere.

160
rharolde
W
william.myers1Network VIP Newbie
asked in Integrity
Looking for advice and inspiration for DHCP DNS & DDNS Domain Configuration

Greetings,I’m looking for recommendations and best practices regarding DHCP-scoped DNS domain assignment across different segments of our environment.Specifically, I’d appreciate guidance on configuring the following DHCP options: Domain Name DDNS Domain Name Domain Search For those of you managing medium to large environments: are you using the same values across internal LAN, Wi-Fi, Guest, and IoT networks? Or do you define zone-specific values like wifi.contoso.com, internal.contoso.com, guest.contoso.com, iot.contoso.com, etc.?Currently, our global DHCP configuration looks like this: Domain Name: contoso.com DDNS Domain Name: mydomain.contoso.com Domain Search: undefined My assumption is that the Domain Name and DDNS Domain Name should ideally match—or at the very least, both should be included in the Domain Search (Option 119) if they differ.I’m also assuming that BYOD and guest networks should ideally have their own distinct DDNS zones, separate from the Active Directory

561
D
D
dittmanAuthenticated Nodes
asked in Integrity
Automating custom certificates in 9.6.x

I want to automate adding my custom certificates in 9.6.x (and later 25.x).  I’ve found references to older versions of Integrity for file locations but have they changed in 9.6.x?  If so, which directory?

15314
D
moni.veronese
moni.veroneseCommunity Manager
published in Micetro
[Video] Micetro - Feature of the Month - July 2025Video

This month, we’re highlighting Micetro, our powerful, easy to deploy IPAM solution designed to bring clarity and control to your DDI environment. Whether you’re managing on-prem, cloud, or hybrid structure, Micetro delivers a unified view that simplifies administration across all your servers, firewalls, and routers

70
moni.veronese
moni.veronese
moni.veroneseCommunity Manager
published in Micetro
[Video] Micetro - Feature of the Month
[Video] Micetro - Feature of the MonthFeature of the Month

This month, we’re highlighting Micetro, our powerful, easy to deploy IPAM solution designed to bring clarity and control to your DDI environment. Whether you’re managing on-prem, cloud, or hybrid structure, Micetro delivers a unified view that simplifies administration across all your servers, firewalls, and routers.

90
moni.veronese
D
dittmanAuthenticated Nodes
asked in Gateway & Adaptive Apps
BSUS and service overrides

For anyone out there using BSUS, how many services do you have in override mode and of those, are you managing them using scripts or manually?

683
moni.veronese
rharolde
rharoldeDNS/DHCP/IPAM at U of Michigan
asked in Integrity
Blocking inherited 'allow MAC Pool'

I set a list of ‘allow MAC Pool’ for a block, but for one specific network I want an open DHCP range.  I cannot figure out how to block the inherited ‘allow MAC Pool’s, or set an ‘allow any’.  I really don’t want to have to copy and maintain a list of ‘allow MAC Pool’s on every network individually. 

16210
rharolde
T
tmaestasActive Endpoint
asked in Integrity
Integrity support for ECS

Since I just became aware that Bluecat is shipping the subscriber version of BIND, which supports EDNS Client Subnet (ECS) for resolver - is adding ECS options supported?  BAM doesn’t natively support any of them, but you could add them using raw options.  We have some use cases that would benefit from ECS but I don’t want to add something in if it’s not officially supported and/or might unexpectedly disappear in future versions.

134
T
T
tmaestasActive Endpoint
asked in Integrity
CVE-2025-40776 - subscriber-edition of BIND?

HOTFIX-590 released to fix CVE-2025-40776, but that CVE only affects the subscriber-edition of BIND which provides ECS support - and as far as I was aware Integrity doesn’t ship with the subscriber version?  

572
T
bshorland
bshorlandBlueCat Employee
published in Integrity
How our community helped shape what’s next with Integrity X
How our community helped shape what’s next with Integrity XLayer 8 Lounge

How our community helped shape what’s next with Integrity X At BlueCat, we believe that innovation doesn’t happen in a vacuum—it happens in partnership. With the release of Integrity X, our most significant and forward-looking platform update to date, we’re proud to say this wasn’t built for our customers—it was built with them.Through deep engagement with our user community, customer surveys, design interviews, and independent research with Enterprise Management Associates, one message came through loud and clear: network teams are under pressure to move faster, scale smarter, and automate everything, with a DDI platform that's unified and intuitive.That’s why Integrity X is more than a product release—it’s a response to what we heard from you. From the ground up, we’ve rebuilt the experience into a unified, intuitive, API-powered platform that can enable you to treat DNS and DHCP as code. The same RESTful APIs that Integrity X is built on top of are the ones your automation teams can

670
bshorland
R
rahveeProvisioned Rookie
asked in Integrity
Creating an IP address in the v2 API

I have selected an UNASSIGNED ip address, and I want to assign it. I think this means basically two steps: Creating an A record and creating a PTR record (it seems there might be a 3rd step to do first, create the IP address object). Since creating an A record is something we’ll want to do sometimes even when we’re not assigning a new IP, I figured I would start by trying to accomplish the task: Simply write a method to create an A record.def record_a_create(self, views, fqdn, ipaddresses, change_control_comment = None):views is a list of strings, e.g. `[‘internal’,’external’]`fqdn is a str, e.g. “foobar.example.com”I have a method that takes a fqdn and searches to find which zone(s) that fqdn should be in, so I can POST to zone(s).ipaddresses is a list of either str, e.g. [‘192.168.1.1’, ‘192.168.1.2’]I think I need to, for each view, look up its ID. (No problem). And then to create the A record via:POST /api/v2/views/{view_id}/resourceRecords{  "type": "HostRecord",  "name": "fqdn", 

804
R
R
rahveeProvisioned Rookie
asked in Integrity
In BAM v2 API, how to find records that point to an IP address

We often have users delete A records, but neglect the “Delete linked IP address if orphaned” checkbox. This results in IP addresses that are unused, but in the web UI they still appear with a blue icon (state = “STATIC”) instead of gray icon (state = “UNASSIGNED”). I am trying to search a subnet for unused IP addresses, that are statically assigned but with no records pointing to them. I’m able to get the network easily enough.url = f"{self.url_base}/networks&filter=range:eq('{target_cidr}')"And then I’m able to get a list of all the IP addresses in the network easily enoughurl = f"{self.url_base}/networks/{network['id']}/addresses(I was also able to use a filter to get “UNASSIGNED” addresses in one go. Worked great, if only that was all I needed to get).I’m able to loop over all the IP addresses. This works perfectly fine, but performance is terrible, because I’m hitting the API for every IP address, 100ms per call * 300 calls = 30 sec to complete. By comparison when I browse the

382
R
R
rahveeProvisioned Rookie
asked in Integrity
Automating Bluecat Address Manager

Hi, if it makes any difference, I do have a support contract with Bluecat, so I can open official support requests if that’s a good approach for me. I haven’t done that yet. I figured I’d reach out to the community first.My first question is to ensure the direction I’m going is the most recommended direction. I have BlueCat Address Manager. I’m not sure which of these version strings is useful when asking a question here in the forum.  ;-) When I browse to the BAM and click on Help, there is no “About” to simply tell me the version of BAM we have. There is Help > API Documentation, it says version “9.5 RESTful v2 API.” I couldn’t figure out how to query system-info using API v2, but when I query the version from “/system-info” via API v1, I get version string “'9.5.1-049.GA.bcn'”.I want to automate creation/deletion of CNAME records to support cert automation. I can use any language or tool, including python, terraform, or anything else. My first question is what’s recommended? So f

1088
bshorland
T
thierry.van-molNetwork VIP Newbie
asked in Integrity
Best away to retrieve HostRecords in a zone with their addresses

I am using API v2 to retrieve all RR in a zone.I use the call “/api/v2/zones/<id>/resourceRecords”In parsing the output, in the case of TXT, SRV, Generic Records I get directly the rdata in the json() .But in case of a HostRecord I need to use the json()[‘data’]['_links']['addresses']['href'] to make an additional API call to get the actual IPv4 addresses of the RR.Problem: I am dealing with a huge zone ( > 300’000 entries), and this takes a long time…..Is there a way to retrieve directly with a single API call the RR of a zone with all the data, kind of a dump of a zone?  

937
moni.veronese
rharolde
rharoldeDNS/DHCP/IPAM at U of Michigan
asked in Integrity
Need v2 API to create an External Host Record

The migration doc says v1 “POST /Services/REST/v1/addExternalHostRecord” becomes “POST /api/v2/zones/{collectionId}/resourceRecords”, but there is no ‘zone’ for an ExternalHost record.  So what collectionId should I use? 

312
rharolde
mark.mikhail
mark.mikhailProduct Marketing Manager
published in Edge
Building DNS GSLB with BlueCat
Building DNS GSLB with BlueCatDNS GSLB

Building DNS GSLB with BlueCat From the beginning, we knew that building a DNS-based Global Server Load Balancing (GSLB) solution required more than just engineering—we needed real-world insight from the people who run the networks every day. So we turned to you, our community!Through surveys and feedback from over 50 organizations across industries and geographies, you helped us zero in on what matters: the importance of prioritizing DNS responses based on network topology and health check results, the need for flexible support of both external and internal services, and the growing demand for compatibility with hybrid-cloud environments. You confirmed what we suspected – DNS reliability, integration, and performance is impacted on how close we are to the network edge – but the cost of GSLB is the biggest barrier to making this a true reality. We believe that Edge Service Points can solve that problem for DNS GSLB!We already know powerful, practical ways you're doing DNS GSLB with an

2173
moni.veronese
D
dominik.krausNetwork VIP Newbie
asked in Gateway & Adaptive Apps
Global Server Selector Custom Healtchecks

Hi Community,  we are planning to implement the Global Server Selector and as of now i’m wondering how the custom healthchecks are working. We can archive what we need we the onboard healthchecks but I’m curious how the custom healthchecks are working since it is no where described how to really implement one.  Has anybody already implemented a custom healthcheck and can share more insights on them?  Thx 

835
moni.veronese
worrabkram
worrabkramBlueCat Employee
posted in Micetro
Getting started with the Micetro REST API

I’m often asked when I speak to customers and prospects about how to use the Micetro REST API. Hopefully this little guide will help…Getting started with Micetro APIs Some background on the various APIs that Micetro supports for automationhttps://docs.menandmice.com/en/latest/guides/user-manual/automation/Public link to REST/SOAP API documentation for all Micetro versionshttps://api.menandmice.com/Although all APIs continue to be supported it’s recommended going forward that customers focus on the REST API Swagger InterfaceMicetro includes a swagger interface which as well as documenting the REST API also allows you to test and try out API calls. This can be accessed by appending /mmws/api/doc/ to your Micetro web gui. Eg:http[s]://micetro.yourdomain.tld/mmws/api/docMicetro swaggerStarting with version 11.1 we now support Bearer tokens. Follow the link to sessions Eg:Fill out your credentials then click execute –Then click on authorise and copy the session returned in the response body

981
moni.veronese

Badge winners

  • BCIA Product User
    leeme1has earned the badge BCIA Product User
  • Integrity Product User
    leeme1has earned the badge Integrity Product User
  • NVIP 2.0 Founding Member
    leeme1has earned the badge NVIP 2.0 Founding Member
  • NVIP 2.0 Founding Member
    rghitshas earned the badge NVIP 2.0 Founding Member
  • Gateway Product Expert
    Davehas earned the badge Gateway Product Expert
Show all badges
Terms & ConditionsCookie settings