Discuss BlueCat products

Does anyone know what the requirements are for a BDDS to show up in the Visualization/Dashboards section with the new metrics?  I know it must be running 25.x, however I’ve added a new BDDS in my lab and it’s not showing up.  I performed the following sequence:BAM → upgraded from 25.1 to 25.1.1 (previous to 25.1 it was running 9.5.2).BDDS→ Added to BAM while the BDDS was running 9.5.2BDDS->Upgraded to 25.1.1BDDS does not show up in Visualization but shows connected to BAM and can receive deployments and otherwise operates normally.BAM->Disabled/enabled the BDDS, restarted BAM, disabled/replaced, deleted/readded the BDDS while it was running 25.1.1.  Stopped/started the metrics exporter service. Nothing I do seems to get it to show up.  It’s clearly getting filtered (like the rest of the BDDS’s running 9.x attached to this BAM) - but I can’t see why.  The API calls being made by the UI are returning the full list of servers. 

When perusing Global->Transactions, if you click white space in the table the fly-out window presents a barebones representation of the transaction (just an object id, no IP or Name or other object-identifying data).  It also lists an Operations heading, but there are never any Operations underneath it.  It took me awhile to figure out that there ARE actually operations present, but for some reason they are not presented in the fly-out window.  You have to instead click on the Transaction operation link in the table which then loads the transaction and lists the operations.  Is this a bug in that the fly-out window is not showing operations (despite there being an Operations section in the window)?  Or just non-intuitive working as designed? 

We are working on a script to read route tables and with some automatic enrichment and human validation, add missing IP Networks (as IP4Network/IP6Network objects) to Integrity. Since creating a network requires providing the parent IP Block ID, I am wondering what the ‘right’ way is to find the parent for a CIDR range that may or may not exist as an IP?Network already in the IPAM database.I have tried the following:filter=range:contains(“204.0.113.0/24”) - which errors (because ‘contains’ doesn’t work with CIDR)filter=range:contains(“204.0.113.0”) - where I just take the lowest IP in the CIDR range. This works but seems sub-optimal to me for some reason. Maybe because I can’t be sure if the block fits the entire CIDR, though that seems unlikely to be a real problem in practice.I have also tried various forms of range:le and range:ge but (as documented) they only match on the prefix length and protocol (dete

Is anyone else out there experiencing failures when building custom containers using either v25.1.0 or v25.1.1 as their dockerfile FROM sources?Example:0.372 Get:1 http://deb.debian.org/debian bullseye InRelease [75.1 kB] 0.454 Get:2 http://deb.debian.org/debian-security bullseye-security InRelease [27.2 kB] 0.497 Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.0 kB] 0.543 Ign:4 http://deb.debian.org/debian bullseye-backports InRelease0.581 Get:5 http://deb.debian.org/debian bullseye/main

Visionary Whiteboard: Simplifying Network Management with BlueCat Micetro and Edge See how BlueCat’s Visionary Whiteboard session reimagines DNS and DHCP for today’s hybrid, multi-cloud environments. Follow the story of an IT admin as their network grows from simple Active Directory infrastructure to a complex mix of on-prem, open-source, and cloud systems.Watch how Micetro by BlueCat centralizes visibility, unifies automation, and simplifies integration with tools like ServiceNow and Azure Private Link—culminating in a look at the intelligent, secure future of network operations

Is there an ETA for integrating Micetro DNS services and Cloudflare? Thanks,Mark 

Join Cisco to learn about how Micetro works in Meraki environments. In this webinar, you’ll hear:Relatable stories from the field Practical insights on simplifying operations and maximizing ROI Clear answers to common branch networking challengesWhether you manage a handful of sites or thousands, see how Cisco and BlueCat together create a branch networking solution that’s ready for anything.   

We're looking to install another site with recursive and authoritative DNS. I’ve done some looking into the multi-primary function though unsure if this is what we're looking for. The goal is to have this site’s DNS/DHCP intact in a disaster scenario where the primary data center is down or unreachable. I am only finding instructions on how to setup multi-primary roles on new zones without existing primary roles. In my attempt to test this I was not able to use or add a new multi-primary role to existing zone as it complains there is already a primary role. Looks like you would have to remove the existing primary role to add the new role, though not sure of the impact here.Can a multi-primary DNS setup function if the BAM is unreachable? How do you install multi-primary roles on existing zones with little or no impact to clients? 

We have run into a situation where our virtual compute provisioning stack is experiencing duplicate IP assignments from Bluecat.  They are POSTing to the v2 API endpoint /api/v2/networks/{collection}/addresses without specifying an address, allowing BAM to allocate the next available.  When multiple requests are submitted in quick succession (within the same second) for the same network, BAM sometimes returns the same IP to both requests with an HTTP 201 code, causing the provisioning automation to assign the same IP to multiple VMs.Other than single-threading the provisioning (which is problematic if different stacks of provisioning automation are provisioning on the same networks) - are there any thoughts of how to avoid this and has anyone else run into it?  This is supposedly confirmed as a defect and there was originally a recommendation to use the v1 assignNextAvailableIP4Address call instead - but when I pushed for assurance that this call would not suffer from the sam

I would be interested in how people are using UDLs in real life.  I have not used them yet, but it seems like I probably should somewhere.

I tried filtering AAAA responses per the KI 000016351 by adding this:plugin query "/usr/lib/filter-aaaa.so" { filter-aaaa-on-v4 yes;};I get the following error:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 14:15:21 UTC 2025/etc/named.conf:32: unknown option 'plugin'If I try without the plugin statement I get this:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 13:58:23 UTC 2025/etc/named.conf:32: option 'filter-aaaa-on-v4' no longer existsDoes anyone know the new way to do this in Integrity 25?

I’ve upgraded my lab to 25.1 and have found that the Let’s Encrypt certs aren’t working as expected.  I don’t see errors in Firefox or Chrome but code to check the certs are failing against 25.1 with the error “ Certificate validation error: FQDN-25.1 [unable to get local issuer certificate]” which lead me to test with curl.I’m wondering if anyone else is seeing the same issue or is this something I’m doing wrong.This is the error I see with “curl -v https://FQDN/”:root@bam:~# curl -v https://FQDN/* Trying 10.0.10.26:443...* Connected to FQDN (10.0.10.26) port 443 (#0)* ALPN: offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):* TLS

Hello,We are migrating our "legacy" v1 API scripts for BAM 9.6.1 to v2 API.In one of those tools, we use v1 "POST /Services/REST/v1/assignNextAvailableIP4Address" to look for a free static IP address. This endpoint provides parameter 'excludeDHCPRange=false' to easily avoid assigning static IP addresses from DHCP Ranges.To achieve the same outcome in v2 API, we should use v2 "POST /api/v2/networks/{collectionId}/addresses" with the 'x-bcn-excluded-addresses' header.But that header is not a Boolean but a list of IPRanges.We're thinking on populating that 'x-bcn-excluded-addresses' header with the output of another API call to "GET /api/v2/networks/{collectionId}/ranges".But even this approach is pretty straight-forward, it feels we are over complicating the process.Are we missing something? Is there any easier way to achieve in v2 API the same

Posting here for anybody subscribed to the Integrity channel The notes have been posted in the Layer 8 Lounge Group: Join the Layer 8 Lounge group to keep up to date with ​​​future events and notes from the calls👉 https://community.bluecatnetworks.com/groups/layer-8-lounge-43

New Integrity X Videos We’ve published 4 new videos to walk you through some of whats new in Integrity X.Each video covers a different theme:  Automation with RESTful APIs New UI  Tagging  Met

I’m attempting to do a POST to /api/v2/networks/{collection-id}/addresses to grab an IP address and put a DNS name on it. This is working find except when I attempt to add a wildcard DNS entry like the following:{    "name": "*.example.net",                             ← This puts a name on the IPv4 address object    "type": "IPv4Address",    "state": "STATIC",    "userDefinedFields": {        "mnemonic": "OCP"    },    "resourceRecords": [        {            "type": "HostRecord",            "absoluteName": "*.example.net",               ← This should put a host record into the example.net zone            "views": [                {                    "id": "93864"                }            ],            "userDefinedFields": {                "mnemonic": "OCP"            }        }    ]}  {    "status"

Since ISC has announced the deprecation of the tkey-gssapi-credential and tkey-domain configuration statements in BIND, both of which are used by Integrity’s current GSSTSIG implementation, can we PLEASE use the refactoring opportunity to get better support for multi-realm GSSTSIG and keytab management?  We currently have to use postDeploy.sh scripting to get the resulting configuration that we want (jettisoning the BAM-generated single-realm keytab and substituting our own, commenting out the BAM-generated tkey-gssapi-credential and tkey-domain statements, and substituting a tkey-gssapi-keytab statement). Ideally BAM should either A) natively support generating a keytab that contains the needed principals and referencing it via the tkey-gssapi-keytab configuration statement (which is ISC’s go-forward requirement) or B) allow the user to import their own keytab and reference that (as other competing products do).I’m sure I have a feature-request for multi-realm support

Greetings,I’m looking for recommendations and best practices regarding DHCP-scoped DNS domain assignment across different segments of our environment.Specifically, I’d appreciate guidance on configuring the following DHCP options: Domain Name DDNS Domain Name Domain Search For those of you managing medium to large environments: are you using the same values across internal LAN, Wi-Fi, Guest, and IoT networks? Or do you define zone-specific values like wifi.contoso.com, internal.contoso.com, guest.contoso.com, iot.contoso.com, etc.?Currently, our global DHCP configuration looks like this: Domain Name: contoso.com DDNS Domain Name: mydomain.contoso.com Domain Sea

I want to automate adding my custom certificates in 9.6.x (and later 25.x).  I’ve found references to older versions of Integrity for file locations but have they changed in 9.6.x?  If so, which directory?

This month, we’re highlighting Micetro, our powerful, easy to deploy IPAM solution designed to bring clarity and control to your DDI environment. Whether you’re managing on-prem, cloud, or hybrid structure, Micetro delivers a unified view that simplifies administration across all your servers, firewalls, and routers

For anyone out there using BSUS, how many services do you have in override mode and of those, are you managing them using scripts or manually?

I set a list of ‘allow MAC Pool’ for a block, but for one specific network I want an open DHCP range.  I cannot figure out how to block the inherited ‘allow MAC Pool’s, or set an ‘allow any’.  I really don’t want to have to copy and maintain a list of ‘allow MAC Pool’s on every network individually.