Netbox-SSOT

Netbox-ssot is a small but powerful microservice designed to keep your Netbox instance in sync with external data sources.

It is designed to be run as a cronjob, and will periodically update Netbox with the latest data from the external sources. It syncs each source in parallel to speed up the process of syncing.

Currently, the supported external data sources types are:

• ovirt
• vmware
• dnac
• proxmox
• paloalto
• PAN-OS firewall
• fortigate
• fmc
• ios-xe
• All devices with ios-xe supporting netconf
• f5
• F5 BIG-IP LTM virtual servers (VIPs) via iControl REST API
• hetznercloud
• Syncs locations, datacenters, servers, networks, floating IPs
• openstack
• Syncs clusters, virtual machines, virtual disks, interfaces, and IP addresses

Compatibility Matrix

[!WARNING] Since netbox introduces breaking changes in minor releases, netbox-ssot also introduces breaking changes in minor releases. See the table below for compatibility between netbox-ssot and netbox.

CLI Flags

Dry Run

Use the --dry-run flag to preview what changes would be made to Netbox without actually applying them. All read operations (fetching existing Netbox state, connecting to sources) execute normally, but all write operations (create, update, delete) are intercepted and logged instead.

# Binary
netbox-ssot --config config.yaml --dry-run

# Docker
docker run -v /path/to/config.yaml:/app/config.yaml ghcr.io/bl4ko/netbox-ssot --dry-run

# Kubernetes (one-off Job)
kubectl create job --from=cronjob/netbox-ssot netbox-ssot-dry-run -- /app/netbox-ssot --config /app/config.yaml --dry-run

Look for [DRY-RUN] entries in the log output to see what would change:

INFO DRY-RUN MODE ENABLED: No changes will be written to Netbox
...
INFO [DRY-RUN] Would create objects.Tag at /api/extras/tags/
INFO [DRY-RUN] Would update objects.Device (ID: 42) with: map[name:server01]
INFO [DRY-RUN] Would delete objects.IPAddress (ID: 99) at /api/ipam/ip-addresses/
INFO [DRY-RUN] Would bulk delete 3 objects at /api/dcim/interfaces/
...
INFO DRY-RUN COMPLETE: Review the log above for [DRY-RUN] entries to see what would change

[!NOTE] During a dry run, created objects are assigned fake IDs (starting at 100,000,000) to maintain internal index consistency. These IDs are never written to Netbox.

Configuration

Netbox-ssot is configured via a single yaml file. The configuration file is divided into three sections:

• logger: Logger configuration
• netbox: Netbox configuration
• source: Array of configuration for each data source

Example configuration can be found here.

Logger

Netbox

Source