NetBox Enterprise System Requirements

Overview

NetBox Enterprise uses an embedded Kubernetes cluster to provide a production-ready NetBox deployment. This document outlines the system, network, and software requirements needed for successful installation and operation.

System Requirements

Hardware Requirements

Additional Requirements:

• Swap must be disabled (Kubernetes requirement)
• SSD or NVMe storage recommended for database performance
• x86-64 architecture required

Operating System Requirements

Host Requirements:

• Linux operating system with x86-64 architecture
• Linux kernel 4.5 or later
• systemd as the init system
• cgroup v2 (unified hierarchy). Required for NetBox Enterprise 2.4.0 and later, which runs Kubernetes 1.35.
• Disk with a maximum P99 write latency of 10 ms
• Required kernel modules: br_netfilter, ip_vs, ip_vs_rr, ip_vs_wrr, ip_vs_sh, overlay

stat -fc %T /sys/fs/cgroup/

NetBox Enterprise supports any Linux distribution that meets these host requirements. The following distributions meet them, some only after you enable cgroup v2. Ubuntu and RHEL have preparation guides.

Compatible Linux Distributions

The Default cgroup column shows the cgroup version the distribution uses after a new default installation. A host upgraded in place can keep an earlier cgroup setting, so run the check above on every host. A distribution that defaults to cgroup v1 needs the kernel parameter systemd.unified_cgroup_hierarchy=1 before you install NetBox Enterprise 2.4.0 or later.

General-Purpose Distributions

Container-Optimized

• RHEL 7.9 and other distributions that cannot run cgroup v2 are not supported from NetBox Enterprise 2.4.0.
• Distributions that do not use systemd, such as Alpine Linux, are not supported.
• SUSE Linux Enterprise Server (SLES) is not on the list above because NetBox Enterprise Embedded Cluster has not been tested on it. A SLES host that passes the cgroup v2 check above and meets the other host requirements meets the Embedded Cluster requirements. SLES 15 SP6 and later default to cgroup v2. SLES 15 SP5 and earlier default to cgroup v1 and need the kernel parameter systemd.unified_cgroup_hierarchy=1.
• For optimal support and security updates, we recommend using actively maintained LTS (Long Term Support) versions.
• Enterprise Linux distributions (RHEL, Rocky Linux, Oracle Linux) provide excellent stability for production deployments.
• Container-optimized distributions are suitable for advanced users familiar with immutable infrastructure patterns.

Enable cgroup v2

On a distribution that defaults to cgroup v1, add the kernel parameter systemd.unified_cgroup_hierarchy=1 and reboot.

On RHEL 8, Rocky Linux 8 and Oracle Linux 8:

sudo grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=1"
sudo reboot

On Ubuntu 20.04, append systemd.unified_cgroup_hierarchy=1 inside the quotes of GRUB_CMDLINE_LINUX in /etc/default/grub, after any existing parameters, then run:

sudo update-grub
sudo reboot

On SLES 15 SP5 and earlier, make the same change to /etc/default/grub, then run:

sudo grub2-mkconfig -o /boot/grub2/grub.cfg
sudo reboot

After the reboot, run stat -fc %T /sys/fs/cgroup/ again and confirm the output is cgroup2fs.

Network Requirements

This section is the one list of the ports, networks, and hostnames for NetBox Enterprise on Embedded Cluster. The Ubuntu and RHEL pages turn this list into firewall commands. The list is the same for every Linux distribution.

Network Configuration:

• Static IP address required (no DHCP)
• Hostname must be fully qualified domain name (FQDN) or resolvable short name

Inbound ports

Open these ports on the host firewall and on any network firewall or cloud security group between the nodes and their clients. A single-node installation needs only the ports marked All installations. A multi-node installation needs every port in the table. If you plan to add nodes later, open all of them now.

To limit a rule to known clients, add their source addresses to it. For example, to allow the Admin Console only from an administrator network, use sudo ufw allow from 192.0.2.0/24 to any port 30000 proto tcp, sudo iptables -I INPUT -p tcp -s 192.0.2.0/24 --dport 30000 -j ACCEPT, or a firewalld rich rule such as sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.0.2.0/24" port port="30000" protocol="tcp" accept'. For the Multi-node only ports, allow the nodes named in the Open on and Allow from columns. A node that joins also needs port 30000 on a controller. If one node cannot reach another on the Calico VXLAN port, pod traffic between those two nodes fails.

On a host where firewalld runs, the installer opens the Multi-node only ports itself, and it adds the pod and service networks to an ec-net zone that accepts all of their traffic. It does not open the All installations ports, and it does not configure UFW, iptables, or a network firewall. The firewalld setup is best-effort: if it fails, the installer logs the error at debug level and continues. A reset removes the five opened ports from the default zone, including rules that you added for them yourself.

Ports that need no firewall rule

The cluster also binds these ports. No other node or client needs to connect to them, so they need no allow rule. The ports marked All interfaces accept connections from the network, so block them with a host firewall or a network rule unless a remote monitor must scrape them. The installer preflight fails if another process already uses one of them.

Ports that NetBox Enterprise does not use

Earlier versions of this page and of the distribution pages listed these ports. NetBox Enterprise does not use them, so you can close them.

Pod and service networks

The installer takes one private range and splits it in two: the first half for pods and the second half for services. The firewall must accept traffic from both halves.

If the default range overlaps a network that the nodes must reach, pass a different /16 or larger private range with --cidr when you install. Then use the two halves of your range in the firewall rules instead of the defaults.

Outbound hostnames

An online installation must reach these hostnames over HTTPS. An air-gapped installation (install --airgap-bundle) needs none of them.

Some optional features need more hostnames, such as Private Copilot and the NetBox Data Exchange catalog. Their pages list them.

The facts in this section come from the source code of these versions:

• NetBox Enterprise: 2.4.0
• Embedded Cluster: 2.19.9+k8s-1.35
• k0s: v1.35.6+k0s.0
• Admin Console (KOTS): 1.131.8

Special Configurations

Proxy Environments

NetBox Enterprise supports installation through proxies (version 1.6.0+).

Proxy Configuration:

Before installing, configure your proxy to allow *.enterprise.netboxlabs.com. If your proxy does not support wildcard hostnames, allow each host in Outbound hostnames instead.

Installation with Proxy:

Pass proxy arguments to the NetBox Enterprise installer when following the installation guide:

sudo ./netbox-enterprise install \
  --license license.yaml \
  --http-proxy http://proxy.example.com:8888 \
  --https-proxy http://proxy.example.com:8888

Proxy Options:

• --http-proxy <proxy-url> and --https-proxy <proxy-url>

  The proxy URL should be a complete URL to reach the proxy (e.g., http://myhost:8888).

• --no-proxy

  By default, the installer will automatically disable proxying on internal cluster addresses and the default network interface. If the installer can't autodetect an interface or you have a more complicated network, specify this manually as a comma-separated list of addresses with CIDR netmasks (1.2.3.4/32) or domains (foo.com, *.bar.com).

Man-In-The-Middle (MITM) Proxies

If you are using a MITM proxy (one that uses an internal TLS certificate authority for communication with the proxy, rather than directly passing encrypted traffic), you will need an additional option:

• --private-ca </path/to/private-ca-bundle>

This allows the cluster to accept traffic encrypted using your internal CA.

Firewalld (Common on RHEL)

The installer configures firewalld for the cluster ports and the pod and service networks. You must still open the ports for users and administrators. The commands are in RHEL Step 3: Configure Firewalld, and they work on any distribution that runs firewalld.

SELinux (RHEL Systems)

NetBox Enterprise can run with SELinux in enforcing mode, but requires initial installation in permissive mode.

Step 1: Disable SELinux Enforcement Temporarily

sudo setenforce 0

Step 2: Install NetBox Enterprise

Follow the standard installation guide.

Step 3: Configure SELinux Policies

After installation completes, configure SELinux to allow NetBox Enterprise operations:

export EC_DIR="/var/lib/embedded-cluster"
export KUBE_DIR="${EC_DIR}/k0s"

# Mark cluster directory for containerd
sudo semanage fcontext -a -t container_var_lib_t "${EC_DIR}"
sudo restorecon -R -v "${EC_DIR}"

# Allow binary execution
sudo semanage fcontext -a -t container_runtime_exec_t "${KUBE_DIR}/bin/containerd.*"
sudo semanage fcontext -a -t container_runtime_exec_t "${KUBE_DIR}/bin/runc"
sudo restorecon -R -v "${KUBE_DIR}/bin"

# Configure containerd permissions
sudo semanage fcontext -a -t container_var_lib_t "${KUBE_DIR}/containerd(/.*)?"
sudo semanage fcontext -a -t container_ro_file_t "${KUBE_DIR}/containerd/io.containerd.snapshotter.*/snapshots(/.*)?"
sudo restorecon -R -v ${KUBE_DIR}/containerd

Step 4: Re-enable SELinux Enforcement

sudo setenforce 1

Or reboot to apply permanently.

Storage Planning

For single-node deployments, NetBox Enterprise uses local storage by default. If you plan to deploy a multi-node cluster, you must configure external S3-compatible storage before adding additional nodes.

Review your storage options early:

• Storage Options - Compare local vs. external storage
• Storage Installation - Configure S3-compatible storage
• Multi-Node Deployment - Requirements for multi-node clusters
• Volume sizes and disk space - Default volume sizes, and how the database and its backups use the disk

Next Steps

1. Follow distribution-specific preparation: Ubuntu or RHEL
2. Proceed to the installation guide

See also: Linux system changes, Troubleshooting