What my automation is never allowed to do

Description and use

An automated sync script that reads FortiGate, MikroTik, and Proxmox, applies safety rules, and updates NetBox without risking data deletion.

Problem

Automating inventory sync between network devices and NetBox while preventing unintended destructive actions.

Outcome

The script reliably syncs device state to NetBox without accidental deletions, flags misconfigurations, and ensures IP availability is accurately reflected.

Workflow

• 1. Collect data from FortiGate (REST API), MikroTik (RouterOS API), Proxmox VE (API token) and perform a local network sweep (ping + ARP).
• 2. Apply four safety rules: (a) least privilege – read‑only accounts on devices, (b) retire but never delete – mark missing items as deprecated, (c) dry‑run preview – show all changes before applying, (d) free‑address logic – ensure IPAM reflects true availability and sweep for unknown hosts.
• 3. If dry‑run passes, write changes to NetBox and log a Journal Entry.
• 4. Optional manual prune with --prune to delete objects tagged [netbox-sync] that were created by the script.
• 5. Monitor logs for alerts on orphan DHCP servers, missing interfaces, under‑reported VM disks, MAC conflicts, and hypervisor overcommit.
• 6. Repeat nightly via systemd timer; run on demand via shortcut.

Evidence

I wanted NetBox to reflect what my lab actually runs, not what I remembered to type into it.

Source

The script never needs to change the network, so it never gets the ability to.

Source

That rule is fine until an API call times out. Then one bad night wipes good data, and the next morning your source of truth says the VLAN never existed.

Source

A preview that shows less than the real run is worse than no preview: it gives you confidence you didn't earn.

Source

NetBox was happy to suggest addresses inside my DHCP pools — addresses the DHCP server could hand to a phone at any moment.

Source