Integrity

We are working on a script to read route tables and with some automatic enrichment and human validation, add missing IP Networks (as IP4Network/IP6Network objects) to Integrity. Since creating a network requires providing the parent IP Block ID, I am wondering what the ‘right’ way is to find the parent for a CIDR range that may or may not exist as an IP?Network already in the IPAM database.I have tried the following:filter=range:contains(“204.0.113.0/24”) - which errors (because ‘contains’ doesn’t work with CIDR)filter=range:contains(“204.0.113.0”) - where I just take the lowest IP in the CIDR range. This works but seems sub-optimal to me for some reason. Maybe because I can’t be sure if the block fits the entire CIDR, though that seems unlikely to be a real problem in practice.I have also tried various forms of range:le and range:ge but (as documented) they only match on the prefix length and protocol (determined based on whether the address is v4 or v6), and so is not useful in this

We're looking to install another site with recursive and authoritative DNS. I’ve done some looking into the multi-primary function though unsure if this is what we're looking for. The goal is to have this site’s DNS/DHCP intact in a disaster scenario where the primary data center is down or unreachable. I am only finding instructions on how to setup multi-primary roles on new zones without existing primary roles. In my attempt to test this I was not able to use or add a new multi-primary role to existing zone as it complains there is already a primary role. Looks like you would have to remove the existing primary role to add the new role, though not sure of the impact here.Can a multi-primary DNS setup function if the BAM is unreachable? How do you install multi-primary roles on existing zones with little or no impact to clients? 

We have run into a situation where our virtual compute provisioning stack is experiencing duplicate IP assignments from Bluecat.  They are POSTing to the v2 API endpoint /api/v2/networks/{collection}/addresses without specifying an address, allowing BAM to allocate the next available.  When multiple requests are submitted in quick succession (within the same second) for the same network, BAM sometimes returns the same IP to both requests with an HTTP 201 code, causing the provisioning automation to assign the same IP to multiple VMs.Other than single-threading the provisioning (which is problematic if different stacks of provisioning automation are provisioning on the same networks) - are there any thoughts of how to avoid this and has anyone else run into it?  This is supposedly confirmed as a defect and there was originally a recommendation to use the v1 assignNextAvailableIP4Address call instead - but when I pushed for assurance that this call would not suffer from the same suscepti

I would be interested in how people are using UDLs in real life.  I have not used them yet, but it seems like I probably should somewhere.

I tried filtering AAAA responses per the KI 000016351 by adding this:plugin query "/usr/lib/filter-aaaa.so" { filter-aaaa-on-v4 yes;};I get the following error:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 14:15:21 UTC 2025/etc/named.conf:32: unknown option 'plugin'If I try without the plugin statement I get this:root@bdds75a:/var/log# cat check-bind.log Fri Aug 29 13:58:23 UTC 2025/etc/named.conf:32: option 'filter-aaaa-on-v4' no longer existsDoes anyone know the new way to do this in Integrity 25?

I’ve upgraded my lab to 25.1 and have found that the Let’s Encrypt certs aren’t working as expected.  I don’t see errors in Firefox or Chrome but code to check the certs are failing against 25.1 with the error “ Certificate validation error: FQDN-25.1 [unable to get local issuer certificate]” which lead me to test with curl.I’m wondering if anyone else is seeing the same issue or is this something I’m doing wrong.This is the error I see with “curl -v https://FQDN/”:root@bam:~# curl -v https://FQDN/* Trying 10.0.10.26:443...* Connected to FQDN (10.0.10.26) port 443 (#0)* ALPN: offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):* TLSv1.3 (IN), TLS handshake, Certificate (11):* TLSv1.3 (OUT), TLS alert, unknown CA (560):* SSL certificate problem: unable to get local issuer certificate* Closing connec

Hello,We are migrating our "legacy" v1 API scripts for BAM 9.6.1 to v2 API.In one of those tools, we use v1 "POST /Services/REST/v1/assignNextAvailableIP4Address" to look for a free static IP address. This endpoint provides parameter 'excludeDHCPRange=false' to easily avoid assigning static IP addresses from DHCP Ranges.To achieve the same outcome in v2 API, we should use v2 "POST /api/v2/networks/{collectionId}/addresses" with the 'x-bcn-excluded-addresses' header.But that header is not a Boolean but a list of IPRanges.We're thinking on populating that 'x-bcn-excluded-addresses' header with the output of another API call to "GET /api/v2/networks/{collectionId}/ranges".But even this approach is pretty straight-forward, it feels we are over complicating the process.Are we missing something? Is there any easier way to achieve in v2 API the same behaviour from v1 'excludeDHCPRange=false' ?Thank you very much.

Posting here for anybody subscribed to the Integrity channel The notes have been posted in the Layer 8 Lounge Group: Join the Layer 8 Lounge group to keep up to date with ​​​future events and notes from the calls👉 https://community.bluecatnetworks.com/groups/layer-8-lounge-43

New Integrity X Videos We’ve published 4 new videos to walk you through some of whats new in Integrity X.Each video covers a different theme:  Automation with RESTful APIs New UI  Tagging  Metrics and Visualization A new UI, built for the way you work  Integrity X introduces a fully modern, accessible, and intuitive interface — purpose-built to empower every user. Whether you’re provisioning DHCP, managing IP space, or investigating DNS issues, the UI puts the power of the platform at your fingertips without the noise or clutter. Designed for speed, optimized for clarity, and compliant with WCAG 2.2 AA — it’s a UI every team can work with confidence.Watch the 2-minute UI walkthrough Automation-first. API-Powered.If you can do it in the UI, you can automate it. Integrity X is built entirely on a RESTful API, which also powers the product itself. Use the UI to bootstrap API calls, explore parameters via OpenAPI spec, and even kickstart AI-assisted provisioning. Whether you're build

I’m attempting to do a POST to /api/v2/networks/{collection-id}/addresses to grab an IP address and put a DNS name on it. This is working find except when I attempt to add a wildcard DNS entry like the following:{    "name": "*.example.net",                             ← This puts a name on the IPv4 address object    "type": "IPv4Address",    "state": "STATIC",    "userDefinedFields": {        "mnemonic": "OCP"    },    "resourceRecords": [        {            "type": "HostRecord",            "absoluteName": "*.example.net",               ← This should put a host record into the example.net zone            "views": [                {                    "id": "93864"                }            ],            "userDefinedFields": {                "mnemonic": "OCP"            }        }    ]}  {    "status": 400,    "reason": "Bad Request",    "code": "InvalidFullyQualifiedDomainName",    "message": "The value for resource field 'resourceRecords[0].absoluteName' is not a valid fully quali

Since ISC has announced the deprecation of the tkey-gssapi-credential and tkey-domain configuration statements in BIND, both of which are used by Integrity’s current GSSTSIG implementation, can we PLEASE use the refactoring opportunity to get better support for multi-realm GSSTSIG and keytab management?  We currently have to use postDeploy.sh scripting to get the resulting configuration that we want (jettisoning the BAM-generated single-realm keytab and substituting our own, commenting out the BAM-generated tkey-gssapi-credential and tkey-domain statements, and substituting a tkey-gssapi-keytab statement). Ideally BAM should either A) natively support generating a keytab that contains the needed principals and referencing it via the tkey-gssapi-keytab configuration statement (which is ISC’s go-forward requirement) or B) allow the user to import their own keytab and reference that (as other competing products do).I’m sure I have a feature-request for multi-realm support floating around

Greetings,I’m looking for recommendations and best practices regarding DHCP-scoped DNS domain assignment across different segments of our environment.Specifically, I’d appreciate guidance on configuring the following DHCP options: Domain Name DDNS Domain Name Domain Search For those of you managing medium to large environments: are you using the same values across internal LAN, Wi-Fi, Guest, and IoT networks? Or do you define zone-specific values like wifi.contoso.com, internal.contoso.com, guest.contoso.com, iot.contoso.com, etc.?Currently, our global DHCP configuration looks like this: Domain Name: contoso.com DDNS Domain Name: mydomain.contoso.com Domain Search: undefined My assumption is that the Domain Name and DDNS Domain Name should ideally match—or at the very least, both should be included in the Domain Search (Option 119) if they differ.I’m also assuming that BYOD and guest networks should ideally have their own distinct DDNS zones, separate from the Active Directory

I want to automate adding my custom certificates in 9.6.x (and later 25.x).  I’ve found references to older versions of Integrity for file locations but have they changed in 9.6.x?  If so, which directory?

I set a list of ‘allow MAC Pool’ for a block, but for one specific network I want an open DHCP range.  I cannot figure out how to block the inherited ‘allow MAC Pool’s, or set an ‘allow any’.  I really don’t want to have to copy and maintain a list of ‘allow MAC Pool’s on every network individually. 

Since I just became aware that Bluecat is shipping the subscriber version of BIND, which supports EDNS Client Subnet (ECS) for resolver - is adding ECS options supported?  BAM doesn’t natively support any of them, but you could add them using raw options.  We have some use cases that would benefit from ECS but I don’t want to add something in if it’s not officially supported and/or might unexpectedly disappear in future versions.

HOTFIX-590 released to fix CVE-2025-40776, but that CVE only affects the subscriber-edition of BIND which provides ECS support - and as far as I was aware Integrity doesn’t ship with the subscriber version?  

I have selected an UNASSIGNED ip address, and I want to assign it. I think this means basically two steps: Creating an A record and creating a PTR record (it seems there might be a 3rd step to do first, create the IP address object). Since creating an A record is something we’ll want to do sometimes even when we’re not assigning a new IP, I figured I would start by trying to accomplish the task: Simply write a method to create an A record.def record_a_create(self, views, fqdn, ipaddresses, change_control_comment = None):views is a list of strings, e.g. `[‘internal’,’external’]`fqdn is a str, e.g. “foobar.example.com”I have a method that takes a fqdn and searches to find which zone(s) that fqdn should be in, so I can POST to zone(s).ipaddresses is a list of either str, e.g. [‘192.168.1.1’, ‘192.168.1.2’]I think I need to, for each view, look up its ID. (No problem). And then to create the A record via:POST /api/v2/views/{view_id}/resourceRecords{  "type": "HostRecord",  "name": "fqdn", 

We often have users delete A records, but neglect the “Delete linked IP address if orphaned” checkbox. This results in IP addresses that are unused, but in the web UI they still appear with a blue icon (state = “STATIC”) instead of gray icon (state = “UNASSIGNED”). I am trying to search a subnet for unused IP addresses, that are statically assigned but with no records pointing to them. I’m able to get the network easily enough.url = f"{self.url_base}/networks&filter=range:eq('{target_cidr}')"And then I’m able to get a list of all the IP addresses in the network easily enoughurl = f"{self.url_base}/networks/{network['id']}/addresses(I was also able to use a filter to get “UNASSIGNED” addresses in one go. Worked great, if only that was all I needed to get).I’m able to loop over all the IP addresses. This works perfectly fine, but performance is terrible, because I’m hitting the API for every IP address, 100ms per call * 300 calls = 30 sec to complete. By comparison when I browse the

Hi, if it makes any difference, I do have a support contract with Bluecat, so I can open official support requests if that’s a good approach for me. I haven’t done that yet. I figured I’d reach out to the community first.My first question is to ensure the direction I’m going is the most recommended direction. I have BlueCat Address Manager. I’m not sure which of these version strings is useful when asking a question here in the forum.  ;-) When I browse to the BAM and click on Help, there is no “About” to simply tell me the version of BAM we have. There is Help > API Documentation, it says version “9.5 RESTful v2 API.” I couldn’t figure out how to query system-info using API v2, but when I query the version from “/system-info” via API v1, I get version string “'9.5.1-049.GA.bcn'”.I want to automate creation/deletion of CNAME records to support cert automation. I can use any language or tool, including python, terraform, or anything else. My first question is what’s recommended? So f

I am using API v2 to retrieve all RR in a zone.I use the call “/api/v2/zones/<id>/resourceRecords”In parsing the output, in the case of TXT, SRV, Generic Records I get directly the rdata in the json() .But in case of a HostRecord I need to use the json()[‘data’]['_links']['addresses']['href'] to make an additional API call to get the actual IPv4 addresses of the RR.Problem: I am dealing with a huge zone ( > 300’000 entries), and this takes a long time…..Is there a way to retrieve directly with a single API call the RR of a zone with all the data, kind of a dump of a zone?  

The migration doc says v1 “POST /Services/REST/v1/addExternalHostRecord” becomes “POST /api/v2/zones/{collectionId}/resourceRecords”, but there is no ‘zone’ for an ExternalHost record.  So what collectionId should I use? 

Can anyone from Bluecat comment on the factors that went into the implementation choices for local RPZ zones? Rather than managing actions record-by-record in an RPZ, Integrity writes out a default policy for each zone in the named.conf (and then writes all the records’s (“response policy items” in BAM parlance) rdata as “CNAME .” in the zone file.)This means ALL response policy items in a given response policy (zone) have the same action.  If you want a different action, you have to create a different response policy - and BIND has an upper limit of 64 RPZs.  So essentially I can only have 64 unique responses via local RPZ under Integrity.RPZ itself (natively, in BIND) is much more flexible.  For any given RPZ I can have thousands of records in them each with their own unique action.  So if I have a one-off DNS zone or particular FQDN I want to override resolution for, I don’t have a burn one of my 64 available zones to do so, as Integrity is forcing us to do - I just place the record