BlueCat Integrity | Tips & Discussions

mark.mikhailProduct Marketing Manager

Must-Have or Luxury? The Great DDI Metrics DebateLayer 8 Lounge

Must-Have or Luxury? The Great DDI Metrics DebateWhen it comes to running core network services like DNS, DHCP, and IP address management (DDI), operators are never short on data. Every server, lease, and query leaves behind a trail of metrics: CPU load, query rates, error codes, address utilization, and more. But in practice, not all metrics are created equal.Some teams rely on a small handful of KPIs to keep the lights on. Others build expansive dashboards to capture every detail. And that raises an important question: which DDI analytics are truly essential, and which are just “nice to have”?The metrics that divide opinions• Capacity and forecasting: Some say short-term utilization trends are mission-critical to prevent outages, while others think long-range forecasting is overkill.• Error visibility: NXDOMAINs, SERVFAILs, and other DNS signals can highlight misconfigurations or abuse, but do you need constant monitoring, or just alerts when thresholds are hit?• DHCP insigh

110

1 day ago

dittmanAuthenticated Nodes

asked in Integrity

filter-aaaa-v4 in Integrity 25

I tried filtering AAAA responses per the KI 000016351 by adding this:plugin query "/usr/lib/filter-aaaa.so" { filter-aaaa-on-v4 yes;};I get the following error:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 14:15:21 UTC 2025/etc/named.conf:32: unknown option 'plugin'If I try without the plugin statement I get this:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 13:58:23 UTC 2025/etc/named.conf:32: option 'filter-aaaa-on-v4' no longer existsDoes anyone know the new way to do this in Integrity 25?

192

18 days ago

dittmanAuthenticated Nodes

asked in Integrity

Let's Encrypt Certs in 25.1 vs. 9.6.1

I’ve upgraded my lab to 25.1 and have found that the Let’s Encrypt certs aren’t working as expected. I don’t see errors in Firefox or Chrome but code to check the certs are failing against 25.1 with the error “ Certificate validation error: FQDN-25.1 [unable to get local issuer certificate]” which lead me to test with curl.I’m wondering if anyone else is seeing the same issue or is this something I’m doing wrong.This is the error I see with “curl -v https://FQDN/”:root@bam:~# curl -v https://FQDN/* Trying 10.0.10.26:443...* Connected to FQDN (10.0.10.26) port 443 (#0)* ALPN: offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):* TLSv1.3 (IN), TLS handshake, Certificate (11):* TLSv1.3 (OUT), TLS alert, unknown CA (560):* SSL certificate problem: unable to get local issuer certificate* Closing connec

5213

26 days ago

massodecProvisioned Rookie

asked in Integrity

replicate in API v2 the behaviour of 'excludeDHCPRange=false' from v1 API

Hello,We are migrating our "legacy" v1 API scripts for BAM 9.6.1 to v2 API.In one of those tools, we use v1 "POST /Services/REST/v1/assignNextAvailableIP4Address" to look for a free static IP address. This endpoint provides parameter 'excludeDHCPRange=false' to easily avoid assigning static IP addresses from DHCP Ranges.To achieve the same outcome in v2 API, we should use v2 "POST /api/v2/networks/{collectionId}/addresses" with the 'x-bcn-excluded-addresses' header.But that header is not a Boolean but a list of IPRanges.We're thinking on populating that 'x-bcn-excluded-addresses' header with the output of another API call to "GET /api/v2/networks/{collectionId}/ranges".But even this approach is pretty straight-forward, it feels we are over complicating the process.Are we missing something? Is there any easier way to achieve in v2 API the same behaviour from v1 'excludeDHCPRange=false' ?Thank you very much.

262

26 days ago

moni.veroneseCommunity Manager

posted in Integrity

Notes from the Integrity X community discussion posted in the group

Posting here for anybody subscribed to the Integrity channel The notes have been posted in the Layer 8 Lounge Group: Join the Layer 8 Lounge group to keep up to date with future events and notes from the calls👉 https://community.bluecatnetworks.com/groups/layer-8-lounge-43

28 days ago

moni.veroneseCommunity Manager

published in Integrity

Integrity X Videos: RESTful API Automation, New UI, Metrics & Visualization and TaggingTutorial

New Integrity X Videos We’ve published 4 new videos to walk you through some of whats new in Integrity X.Each video covers a different theme: Automation with RESTful APIs New UI Tagging Metrics and Visualization A new UI, built for the way you work Integrity X introduces a fully modern, accessible, and intuitive interface — purpose-built to empower every user. Whether you’re provisioning DHCP, managing IP space, or investigating DNS issues, the UI puts the power of the platform at your fingertips without the noise or clutter. Designed for speed, optimized for clarity, and compliant with WCAG 2.2 AA — it’s a UI every team can work with confidence.Watch the 2-minute UI walkthrough Automation-first. API-Powered.If you can do it in the UI, you can automate it. Integrity X is built entirely on a RESTful API, which also powers the product itself. Use the UI to bootstrap API calls, explore parameters via OpenAPI spec, and even kickstart AI-assisted provisioning. Whether you're build

420

29 days ago

christopher.nielsenNetwork VIP Newbie

asked in Integrity

V2 API create wildcard host record via address API /api/v2/networks/{collection-id}/addresses

I’m attempting to do a POST to /api/v2/networks/{collection-id}/addresses to grab an IP address and put a DNS name on it. This is working find except when I attempt to add a wildcard DNS entry like the following:{ "name": "*.example.net", ← This puts a name on the IPv4 address object "type": "IPv4Address", "state": "STATIC", "userDefinedFields": { "mnemonic": "OCP" }, "resourceRecords": [ { "type": "HostRecord", "absoluteName": "*.example.net", ← This should put a host record into the example.net zone "views": [ { "id": "93864" } ], "userDefinedFields": { "mnemonic": "OCP" } } ]} { "status": 400, "reason": "Bad Request", "code": "InvalidFullyQualifiedDomainName", "message": "The value for resource field 'resourceRecords[0].absoluteName' is not a valid fully quali

302

1 month ago

moni.veroneseCommunity Manager

published in Integrity

Introducing BlueCat Integrity XNew Release

We are thrilled to unveil the latest updates in our product lineup: BlueCat Integrity X, 25.1. This release represents a transformative step forward in our DNS, DHCP, and IP address management solutions. It empowers IT teams seeking a single platform for complete visibility and control over critical network services.What’s new with Integrity X?At BlueCat, we are committed to creating a unified, intuitive DDI management platform built for the future. Integrity X represents a monumental leap forward in our DDI partnership with customers: it is an innovative release that highlights our unwavering commitment to developing resilient and future-proof solutions that scaleWe’re not just here to help complete manual DDI tasks; we’re here to ignite a visionary transformation, enabling our customers to reimagine how they accomplish work with remarkable speed and efficiency using automation. We’re proud to deliver a release that provides a UI/UX that bridges the gap between manual DDI management a

1803

1 month ago

tmaestasActive Endpoint

posted in Integrity

Integrity GSSTSIG support

Since ISC has announced the deprecation of the tkey-gssapi-credential and tkey-domain configuration statements in BIND, both of which are used by Integrity’s current GSSTSIG implementation, can we PLEASE use the refactoring opportunity to get better support for multi-realm GSSTSIG and keytab management? We currently have to use postDeploy.sh scripting to get the resulting configuration that we want (jettisoning the BAM-generated single-realm keytab and substituting our own, commenting out the BAM-generated tkey-gssapi-credential and tkey-domain statements, and substituting a tkey-gssapi-keytab statement). Ideally BAM should either A) natively support generating a keytab that contains the needed principals and referencing it via the tkey-gssapi-keytab configuration statement (which is ISC’s go-forward requirement) or B) allow the user to import their own keytab and reference that (as other competing products do).I’m sure I have a feature-request for multi-realm support floating around

100

1 month ago

rharoldeDNS/DHCP/IPAM at U of Michigan

posted in Integrity

UDL - User Defined Link

I would be interested in how people are using UDLs in real life. I have not used them yet, but it seems like I probably should somewhere.

160

1 month ago

william.myers1Network VIP Newbie

asked in Integrity

Looking for advice and inspiration for DHCP DNS & DDNS Domain Configuration

Greetings,I’m looking for recommendations and best practices regarding DHCP-scoped DNS domain assignment across different segments of our environment.Specifically, I’d appreciate guidance on configuring the following DHCP options: Domain Name DDNS Domain Name Domain Search For those of you managing medium to large environments: are you using the same values across internal LAN, Wi-Fi, Guest, and IoT networks? Or do you define zone-specific values like wifi.contoso.com, internal.contoso.com, guest.contoso.com, iot.contoso.com, etc.?Currently, our global DHCP configuration looks like this: Domain Name: contoso.com DDNS Domain Name: mydomain.contoso.com Domain Search: undefined My assumption is that the Domain Name and DDNS Domain Name should ideally match—or at the very least, both should be included in the Domain Search (Option 119) if they differ.I’m also assuming that BYOD and guest networks should ideally have their own distinct DDNS zones, separate from the Active Directory

671

1 month ago

dittmanAuthenticated Nodes

asked in Integrity

Automating custom certificates in 9.6.x

I want to automate adding my custom certificates in 9.6.x (and later 25.x). I’ve found references to older versions of Integrity for file locations but have they changed in 9.6.x? If so, which directory?

15414

1 month ago

rharoldeDNS/DHCP/IPAM at U of Michigan

asked in Integrity

Blocking inherited 'allow MAC Pool'

I set a list of ‘allow MAC Pool’ for a block, but for one specific network I want an open DHCP range. I cannot figure out how to block the inherited ‘allow MAC Pool’s, or set an ‘allow any’. I really don’t want to have to copy and maintain a list of ‘allow MAC Pool’s on every network individually.

16210

1 month ago

tmaestasActive Endpoint

asked in Integrity

Integrity support for ECS

Since I just became aware that Bluecat is shipping the subscriber version of BIND, which supports EDNS Client Subnet (ECS) for resolver - is adding ECS options supported? BAM doesn’t natively support any of them, but you could add them using raw options. We have some use cases that would benefit from ECS but I don’t want to add something in if it’s not officially supported and/or might unexpectedly disappear in future versions.

144

1 month ago

tmaestasActive Endpoint

asked in Integrity

CVE-2025-40776 - subscriber-edition of BIND?

HOTFIX-590 released to fix CVE-2025-40776, but that CVE only affects the subscriber-edition of BIND which provides ECS support - and as far as I was aware Integrity doesn’t ship with the subscriber version?

642

2 months ago

bshorlandBlueCat Employee

published in Integrity

How our community helped shape what’s next with Integrity XLayer 8 Lounge

How our community helped shape what’s next with Integrity X At BlueCat, we believe that innovation doesn’t happen in a vacuum—it happens in partnership. With the release of Integrity X, our most significant and forward-looking platform update to date, we’re proud to say this wasn’t built for our customers—it was built with them.Through deep engagement with our user community, customer surveys, design interviews, and independent research with Enterprise Management Associates, one message came through loud and clear: network teams are under pressure to move faster, scale smarter, and automate everything, with a DDI platform that's unified and intuitive.That’s why Integrity X is more than a product release—it’s a response to what we heard from you. From the ground up, we’ve rebuilt the experience into a unified, intuitive, API-powered platform that can enable you to treat DNS and DHCP as code. The same RESTful APIs that Integrity X is built on top of are the ones your automation teams can

680

2 months ago

rahveeProvisioned Rookie

asked in Integrity

Creating an IP address in the v2 API

I have selected an UNASSIGNED ip address, and I want to assign it. I think this means basically two steps: Creating an A record and creating a PTR record (it seems there might be a 3rd step to do first, create the IP address object). Since creating an A record is something we’ll want to do sometimes even when we’re not assigning a new IP, I figured I would start by trying to accomplish the task: Simply write a method to create an A record.def record_a_create(self, views, fqdn, ipaddresses, change_control_comment = None):views is a list of strings, e.g. `[‘internal’,’external’]`fqdn is a str, e.g. “foobar.example.com”I have a method that takes a fqdn and searches to find which zone(s) that fqdn should be in, so I can POST to zone(s).ipaddresses is a list of either str, e.g. [‘192.168.1.1’, ‘192.168.1.2’]I think I need to, for each view, look up its ID. (No problem). And then to create the A record via:POST /api/v2/views/{view_id}/resourceRecords{ "type": "HostRecord", "name": "fqdn",

824

2 months ago

rahveeProvisioned Rookie

asked in Integrity

In BAM v2 API, how to find records that point to an IP address

We often have users delete A records, but neglect the “Delete linked IP address if orphaned” checkbox. This results in IP addresses that are unused, but in the web UI they still appear with a blue icon (state = “STATIC”) instead of gray icon (state = “UNASSIGNED”). I am trying to search a subnet for unused IP addresses, that are statically assigned but with no records pointing to them. I’m able to get the network easily enough.url = f"{self.url_base}/networks&filter=range:eq('{target_cidr}')"And then I’m able to get a list of all the IP addresses in the network easily enoughurl = f"{self.url_base}/networks/{network['id']}/addresses(I was also able to use a filter to get “UNASSIGNED” addresses in one go. Worked great, if only that was all I needed to get).I’m able to loop over all the IP addresses. This works perfectly fine, but performance is terrible, because I’m hitting the API for every IP address, 100ms per call * 300 calls = 30 sec to complete. By comparison when I browse the

442

2 months ago

rahveeProvisioned Rookie

asked in Integrity

Automating Bluecat Address Manager

Hi, if it makes any difference, I do have a support contract with Bluecat, so I can open official support requests if that’s a good approach for me. I haven’t done that yet. I figured I’d reach out to the community first.My first question is to ensure the direction I’m going is the most recommended direction. I have BlueCat Address Manager. I’m not sure which of these version strings is useful when asking a question here in the forum. ;-) When I browse to the BAM and click on Help, there is no “About” to simply tell me the version of BAM we have. There is Help > API Documentation, it says version “9.5 RESTful v2 API.” I couldn’t figure out how to query system-info using API v2, but when I query the version from “/system-info” via API v1, I get version string “'9.5.1-049.GA.bcn'”.I want to automate creation/deletion of CNAME records to support cert automation. I can use any language or tool, including python, terraform, or anything else. My first question is what’s recommended? So f

1128

2 months ago

thierry.van-molNetwork VIP Newbie

asked in Integrity

Best away to retrieve HostRecords in a zone with their addresses

I am using API v2 to retrieve all RR in a zone.I use the call “/api/v2/zones/<id>/resourceRecords”In parsing the output, in the case of TXT, SRV, Generic Records I get directly the rdata in the json() .But in case of a HostRecord I need to use the json()[‘data’]['_links']['addresses']['href'] to make an additional API call to get the actual IPv4 addresses of the RR.Problem: I am dealing with a huge zone ( > 300’000 entries), and this takes a long time…..Is there a way to retrieve directly with a single API call the RR of a zone with all the data, kind of a dump of a zone?

977

2 months ago

rharoldeDNS/DHCP/IPAM at U of Michigan

asked in Integrity

Need v2 API to create an External Host Record

The migration doc says v1 “POST /Services/REST/v1/addExternalHostRecord” becomes “POST /api/v2/zones/{collectionId}/resourceRecords”, but there is no ‘zone’ for an ExternalHost record. So what collectionId should I use?

322

2 months ago

tmaestasActive Endpoint

posted in Integrity

Integrity implementation of RPZ

Can anyone from Bluecat comment on the factors that went into the implementation choices for local RPZ zones? Rather than managing actions record-by-record in an RPZ, Integrity writes out a default policy for each zone in the named.conf (and then writes all the records’s (“response policy items” in BAM parlance) rdata as “CNAME .” in the zone file.)This means ALL response policy items in a given response policy (zone) have the same action. If you want a different action, you have to create a different response policy - and BIND has an upper limit of 64 RPZs. So essentially I can only have 64 unique responses via local RPZ under Integrity.RPZ itself (natively, in BIND) is much more flexible. For any given RPZ I can have thousands of records in them each with their own unique action. So if I have a one-off DNS zone or particular FQDN I want to override resolution for, I don’t have a burn one of my 64 available zones to do so, as Integrity is forcing us to do - I just place the record

14314

4 months ago

dmuscatActive Endpoint

posted in Integrity

Cloud DHCP and Integrity

Would be great if we can use BAM to view all cloud DHCP logs, monitor leases and MAC addresses. much easier than trying to run tools or create query statements just to find a DHCP lease for particular MAC. Does BlueCat have a roadmap and/or plans monitoring cloud DHCP lease data? May in the future pull this data into BAM from CDV?

343

4 months ago

allen.watsonNetwork VIP Newbie

asked in Integrity

What is Integrity?

I am wondering is the Integrity release replacing/upgrade to BlueCat Address Manager or is it a completely different product?

1956

4 months ago

moni.veroneseCommunity Manager

published in Integrity

LiveAction joins the BlueCat family, pair with Integrity

LiveAction is now part of the BlueCat family, bringing market-leading network performance monitoring (NPM) to Integrity users. Get a full picture of your network- from DNS-level insights to comprehensive traffic flows and performance monitoring across all protocols.[Learn more]

914

4 months ago

Integrity

Badge winners

Sign up

Login or Create an Account:

Login to the community

Login or Create an Account:

Scanning file for viruses.

This file cannot be downloaded