VLAN Sync does not honour site/cluster relations

[clontarfx]

I am not sure how this code is doing VLAN lookups and relation to NetBox, it in my example it's hijacking a VLAN that belongs to a different tenant/site. For example I might have a VLAN10 at Site 1, and this script is syncing Site 2 that also has a VLAN10. The code is seemingly finding the "other" VLAN10 and overwriting it (for example by adding tags). Infact after a review, it looks like it's just the tag handling.

I did a quick read and my theory is that it's looking at VLAN ID as the matching attribute. In a multi-tenant multi-site setup this can't be the case, as you will definitely have the same VLAN ID existing at multiple sites/locations/regions. Perhaps it should be making sure both ID and NAME match? Or ID+NAME+SITE/CLUSTER?

[clontarfx]

In the example of one of the hijacked VLANs (sensitive/non-relevant data stripped);

    "id": 55,
    "display": "VLAN10 (10)",
    "site": null,
    "group": null,
    "vid": 10,
    "name": "VLAN10",

    "status": {
        "value": "active",
        "label": "Active"
    },

    "role": null,
    "description": "VLAN10 - Core Management Subnet",
}

Note that the site is null. I would have thought that the site would be checked to match the source site when attempting to create/modify a VLAN. Similarly (removed in this example) the VLAN has a relationship to a tenant. Tenant relations are also part of netbox-sync. So perhaps a fix would be to allow configuration option for vlan_site_relation, vlan_tenant_relation or similar?

[bb-Ricardo]

please read: #474

[Noah418]

I'm having a look at this bug. Could you put in an expected outcome as well? (names changed to stand in ones if needs be) And any extra information like log lines is helpful too. From looking into the code it does check both the site and group when looking for a match, but it might take over a global vlan that matches the vid... just want to get a bit more info to help get it right

[bb-Ricardo]

@Noah418,

Thank you very much for helping out here, this is highly appreciated. I'm still on travels for a few weeks but then should be able to look into this as well.

[semx]

Same defect as finding 3 in #537: the VLAN lookup matches on the VID first and can pick a VLAN from another site or group. @jamespage001 has a scope-aware fix validated against a live environment and was asked to send it as a focused PR against development; I'll link it here when it lands.