Discuss BlueCat products

I tried filtering AAAA responses per the KI 000016351 by adding this:plugin query "/usr/lib/filter-aaaa.so" { filter-aaaa-on-v4 yes;};I get the following error:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 14:15:21 UTC 2025/etc/named.conf:32: unknown option 'plugin'If I try without the plugin statement I get this:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 13:58:23 UTC 2025/etc/named.conf:32: option 'filter-aaaa-on-v4' no longer existsDoes anyone know the new way to do this in Integrity 25?

I’ve upgraded my lab to 25.1 and have found that the Let’s Encrypt certs aren’t working as expected.  I don’t see errors in Firefox or Chrome but code to check the certs are failing against 25.1 with the error “ Certificate validation error: FQDN-25.1 [unable to get local issuer certificate]” which lead me to test with curl.I’m wondering if anyone else is seeing the same issue or is this something I’m doing wrong.This is the error I see with “curl -v https://FQDN/”:root@bam:~# curl -v https://FQDN/* Trying 10.0.10.26:443...* Connected to FQDN (10.0.10.26) port 443 (#0)* ALPN: offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):* TLSv1.3 (IN), TLS handshake, Certificate (11):* TLSv1.3 (OUT), TLS alert, unknown CA (560):* SSL certificate problem: unable to get local issuer certificate* Closing connec

Hello,We are migrating our "legacy" v1 API scripts for BAM 9.6.1 to v2 API.In one of those tools, we use v1 "POST /Services/REST/v1/assignNextAvailableIP4Address" to look for a free static IP address. This endpoint provides parameter 'excludeDHCPRange=false' to easily avoid assigning static IP addresses from DHCP Ranges.To achieve the same outcome in v2 API, we should use v2 "POST /api/v2/networks/{collectionId}/addresses" with the 'x-bcn-excluded-addresses' header.But that header is not a Boolean but a list of IPRanges.We're thinking on populating that 'x-bcn-excluded-addresses' header with the output of another API call to "GET /api/v2/networks/{collectionId}/ranges".But even this approach is pretty straight-forward, it feels we are over complicating the process.Are we missing something? Is there any easier way to achieve in v2 API the same behaviour from v1 'excludeDHCPRange=false' ?Thank you very much.

Posting here for anybody subscribed to the Integrity channel The notes have been posted in the Layer 8 Lounge Group: Join the Layer 8 Lounge group to keep up to date with ​​​future events and notes from the calls👉 https://community.bluecatnetworks.com/groups/layer-8-lounge-43

New Integrity X Videos We’ve published 4 new videos to walk you through some of whats new in Integrity X.Each video covers a different theme:  Automation with RESTful APIs New UI  Tagging  Metrics and Visualization A new UI, built for the way you work  Integrity X introduces a fully modern, accessible, and intuitive interface — purpose-built to empower every user. Whether you’re provisioning DHCP, managing IP space, or investigating DNS issues, the UI puts the power of the platform at your fingertips without the noise or clutter. Designed for speed, optimized for clarity, and compliant with WCAG 2.2 AA — it’s a UI every team can work with confidence.Watch the 2-minute UI walkthrough Automation-first. API-Powered.If you can do it in the UI, you can automate it. Integrity X is built entirely on a RESTful API, which also powers the product itself. Use the UI to bootstrap API calls, explore parameters via OpenAPI spec, and even kickstart AI-assisted provisioning. Whether you're build

I’m attempting to do a POST to /api/v2/networks/{collection-id}/addresses to grab an IP address and put a DNS name on it. This is working find except when I attempt to add a wildcard DNS entry like the following:{    "name": "*.example.net",                             ← This puts a name on the IPv4 address object    "type": "IPv4Address",    "state": "STATIC",    "userDefinedFields": {        "mnemonic": "OCP"    },    "resourceRecords": [        {            "type": "HostRecord",            "absoluteName": "*.example.net",               ← This should put a host record into the example.net zone            "views": [                {                    "id": "93864"                }            ],            "userDefinedFields": {                "mnemonic": "OCP"            }        }    ]}  {    "status": 400,    "reason": "Bad Request",    "code": "InvalidFullyQualifiedDomainName",    "message": "The value for resource field 'resourceRecords[0].absoluteName' is not a valid fully quali

Since ISC has announced the deprecation of the tkey-gssapi-credential and tkey-domain configuration statements in BIND, both of which are used by Integrity’s current GSSTSIG implementation, can we PLEASE use the refactoring opportunity to get better support for multi-realm GSSTSIG and keytab management?  We currently have to use postDeploy.sh scripting to get the resulting configuration that we want (jettisoning the BAM-generated single-realm keytab and substituting our own, commenting out the BAM-generated tkey-gssapi-credential and tkey-domain statements, and substituting a tkey-gssapi-keytab statement). Ideally BAM should either A) natively support generating a keytab that contains the needed principals and referencing it via the tkey-gssapi-keytab configuration statement (which is ISC’s go-forward requirement) or B) allow the user to import their own keytab and reference that (as other competing products do).I’m sure I have a feature-request for multi-realm support floating around

Greetings,I’m looking for recommendations and best practices regarding DHCP-scoped DNS domain assignment across different segments of our environment.Specifically, I’d appreciate guidance on configuring the following DHCP options: Domain Name DDNS Domain Name Domain Search For those of you managing medium to large environments: are you using the same values across internal LAN, Wi-Fi, Guest, and IoT networks? Or do you define zone-specific values like wifi.contoso.com, internal.contoso.com, guest.contoso.com, iot.contoso.com, etc.?Currently, our global DHCP configuration looks like this: Domain Name: contoso.com DDNS Domain Name: mydomain.contoso.com Domain Search: undefined My assumption is that the Domain Name and DDNS Domain Name should ideally match—or at the very least, both should be included in the Domain Search (Option 119) if they differ.I’m also assuming that BYOD and guest networks should ideally have their own distinct DDNS zones, separate from the Active Directory

This month, we’re highlighting Micetro, our powerful, easy to deploy IPAM solution designed to bring clarity and control to your DDI environment. Whether you’re managing on-prem, cloud, or hybrid structure, Micetro delivers a unified view that simplifies administration across all your servers, firewalls, and routers

For anyone out there using BSUS, how many services do you have in override mode and of those, are you managing them using scripts or manually?

I set a list of ‘allow MAC Pool’ for a block, but for one specific network I want an open DHCP range.  I cannot figure out how to block the inherited ‘allow MAC Pool’s, or set an ‘allow any’.  I really don’t want to have to copy and maintain a list of ‘allow MAC Pool’s on every network individually. 

Since I just became aware that Bluecat is shipping the subscriber version of BIND, which supports EDNS Client Subnet (ECS) for resolver - is adding ECS options supported?  BAM doesn’t natively support any of them, but you could add them using raw options.  We have some use cases that would benefit from ECS but I don’t want to add something in if it’s not officially supported and/or might unexpectedly disappear in future versions.

HOTFIX-590 released to fix CVE-2025-40776, but that CVE only affects the subscriber-edition of BIND which provides ECS support - and as far as I was aware Integrity doesn’t ship with the subscriber version?  

I have selected an UNASSIGNED ip address, and I want to assign it. I think this means basically two steps: Creating an A record and creating a PTR record (it seems there might be a 3rd step to do first, create the IP address object). Since creating an A record is something we’ll want to do sometimes even when we’re not assigning a new IP, I figured I would start by trying to accomplish the task: Simply write a method to create an A record.def record_a_create(self, views, fqdn, ipaddresses, change_control_comment = None):views is a list of strings, e.g. `[‘internal’,’external’]`fqdn is a str, e.g. “foobar.example.com”I have a method that takes a fqdn and searches to find which zone(s) that fqdn should be in, so I can POST to zone(s).ipaddresses is a list of either str, e.g. [‘192.168.1.1’, ‘192.168.1.2’]I think I need to, for each view, look up its ID. (No problem). And then to create the A record via:POST /api/v2/views/{view_id}/resourceRecords{  "type": "HostRecord",  "name": "fqdn", 

We often have users delete A records, but neglect the “Delete linked IP address if orphaned” checkbox. This results in IP addresses that are unused, but in the web UI they still appear with a blue icon (state = “STATIC”) instead of gray icon (state = “UNASSIGNED”). I am trying to search a subnet for unused IP addresses, that are statically assigned but with no records pointing to them. I’m able to get the network easily enough.url = f"{self.url_base}/networks&filter=range:eq('{target_cidr}')"And then I’m able to get a list of all the IP addresses in the network easily enoughurl = f"{self.url_base}/networks/{network['id']}/addresses(I was also able to use a filter to get “UNASSIGNED” addresses in one go. Worked great, if only that was all I needed to get).I’m able to loop over all the IP addresses. This works perfectly fine, but performance is terrible, because I’m hitting the API for every IP address, 100ms per call * 300 calls = 30 sec to complete. By comparison when I browse the

Hi, if it makes any difference, I do have a support contract with Bluecat, so I can open official support requests if that’s a good approach for me. I haven’t done that yet. I figured I’d reach out to the community first.My first question is to ensure the direction I’m going is the most recommended direction. I have BlueCat Address Manager. I’m not sure which of these version strings is useful when asking a question here in the forum.  ;-) When I browse to the BAM and click on Help, there is no “About” to simply tell me the version of BAM we have. There is Help > API Documentation, it says version “9.5 RESTful v2 API.” I couldn’t figure out how to query system-info using API v2, but when I query the version from “/system-info” via API v1, I get version string “'9.5.1-049.GA.bcn'”.I want to automate creation/deletion of CNAME records to support cert automation. I can use any language or tool, including python, terraform, or anything else. My first question is what’s recommended? So f

I am using API v2 to retrieve all RR in a zone.I use the call “/api/v2/zones/<id>/resourceRecords”In parsing the output, in the case of TXT, SRV, Generic Records I get directly the rdata in the json() .But in case of a HostRecord I need to use the json()[‘data’]['_links']['addresses']['href'] to make an additional API call to get the actual IPv4 addresses of the RR.Problem: I am dealing with a huge zone ( > 300’000 entries), and this takes a long time…..Is there a way to retrieve directly with a single API call the RR of a zone with all the data, kind of a dump of a zone?  

The migration doc says v1 “POST /Services/REST/v1/addExternalHostRecord” becomes “POST /api/v2/zones/{collectionId}/resourceRecords”, but there is no ‘zone’ for an ExternalHost record.  So what collectionId should I use? 

Hi Community,  we are planning to implement the Global Server Selector and as of now i’m wondering how the custom healthchecks are working. We can archive what we need we the onboard healthchecks but I’m curious how the custom healthchecks are working since it is no where described how to really implement one.  Has anybody already implemented a custom healthcheck and can share more insights on them?  Thx 

I’m often asked when I speak to customers and prospects about how to use the Micetro REST API. Hopefully this little guide will help…Getting started with Micetro APIs Some background on the various APIs that Micetro supports for automationhttps://docs.menandmice.com/en/latest/guides/user-manual/automation/Public link to REST/SOAP API documentation for all Micetro versionshttps://api.menandmice.com/Although all APIs continue to be supported it’s recommended going forward that customers focus on the REST API Swagger InterfaceMicetro includes a swagger interface which as well as documenting the REST API also allows you to test and try out API calls. This can be accessed by appending /mmws/api/doc/ to your Micetro web gui. Eg:http[s]://micetro.yourdomain.tld/mmws/api/docMicetro swaggerStarting with version 11.1 we now support Bearer tokens. Follow the link to sessions Eg:Fill out your credentials then click execute –Then click on authorise and copy the session returned in the response body

Can anyone from Bluecat comment on the factors that went into the implementation choices for local RPZ zones? Rather than managing actions record-by-record in an RPZ, Integrity writes out a default policy for each zone in the named.conf (and then writes all the records’s (“response policy items” in BAM parlance) rdata as “CNAME .” in the zone file.)This means ALL response policy items in a given response policy (zone) have the same action.  If you want a different action, you have to create a different response policy - and BIND has an upper limit of 64 RPZs.  So essentially I can only have 64 unique responses via local RPZ under Integrity.RPZ itself (natively, in BIND) is much more flexible.  For any given RPZ I can have thousands of records in them each with their own unique action.  So if I have a one-off DNS zone or particular FQDN I want to override resolution for, I don’t have a burn one of my 64 available zones to do so, as Integrity is forcing us to do - I just place the record