NetBox Ubuntu 24.04

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size for evaluation and small deployments. For larger inventories, choose a size with more memory.

Configure the NSG to allow inbound 22/tcp from your management network and 80/tcp for the web interface. NetBox serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain (see the final step).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for NetBox by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:netbox-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name netbox \
  --image sac1647283583153:netbox-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
# Open the HTTP port so you can reach the web interface
az vm open-port --resource-group <your-rg> --name netbox --port 80 --priority 900

First boot takes a few minutes. In the background, the VM generates its own credentials and starts the services. If you connect as soon as the VM shows as running, wait for that setup to finish before you continue:

bash sudo cloud-init status --wait

The command prints status: done when the VM is ready. The credentials and services described below exist only after that.

Step 3 - Retrieve the per-VM admin credentials

Nothing secret is baked into the image. On first boot, a one-shot service (netbox-firstboot.service) generates a fresh Django secret key, a fresh database password, a unique administrator account and a REST API token. All of them are unique to your instance.

The service writes them to /root/netbox-credentials.txt, readable only by root. SSH in as azureuser and read the file:

$
sudo cat /root/netbox-credentials.txt
# NetBox - generated on first boot by netbox-firstboot.service.
# These credentials are unique to THIS VM. Store them somewhere safe. netbox.url=http://20.55.10.42/ netbox.admin.user=admin netbox.admin.pass=Xq7pR2mK9wU4nZ8vB3hL6yD1 netbox.api.token=8f3c1e0a9b2d4c6e8f0a1b2c3d4e5f60718293a4
# Canonical keys consumed by the sac smoke verifier + guide substitution: NETBOX_ADMIN_PASSWORD=<set-at-first-boot> NETBOX_API_TOKEN=<set-at-first-boot>

The netbox-firstboot.service one-shot runs before the application services. The web UI therefore starts only after every per-VM secret has been generated.

The values above are an example. Your instance has its own unique credentials.

Step 4 - Confirm the services are running

Check that PostgreSQL, Redis, the NetBox application, the request queue worker and nginx are all active:

sudo systemctl is-active postgresql redis-server netbox netbox-rq nginx

All five report active. gunicorn binds to loopback only (127.0.0.1:8001), and nginx publishes the web interface on port 80:

sudo ss -tlnp | grep -E ':80 |:8001 '

Step 5 - Confirm the web endpoints

The sign-in page is public and returns 200. NetBox requires authentication for everything else. An anonymous request to the application is redirected to the login page, and the REST API returns 403 without a token. This is the secure default.

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/login/

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/api/dcim/devices/

Allow your VM's public address

NetBox answers only on the host names listed in its ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS settings. First boot fills them from the address Azure reports. With a Standard SKU public IP (the Azure default, and the --public-ip-sku Standard in Step 2), that address is the VM's private address.

Check the netbox.url value in /root/netbox-credentials.txt. If it shows a private address such as http://10.0.0.4/, your browser gets Bad Request (400) on the public IP until you add it.

Run this once, replacing <vm-public-ip> with your VM's public IP. Repeat the line for a DNS name if you use one:

PUBLIC_IP=<vm-public-ip>
sudo sed -i "s/^ALLOWED_HOSTS = \[/ALLOWED_HOSTS = ['$PUBLIC_IP', /; s#^CSRF_TRUSTED_ORIGINS = \[#CSRF_TRUSTED_ORIGINS = ['http://$PUBLIC_IP', 'https://$PUBLIC_IP', #" /opt/netbox/netbox/netbox/configuration.py
sudo systemctl restart netbox netbox-rq

The change survives reboots, because first boot runs only once.

Step 6 - Sign in to the web UI

Browse to http://<vm-ip>/, using the public IP you allowed above. Sign in as admin with the password from /root/netbox-credentials.txt.

After you sign in, you land on your personal dashboard. Its widgets summarize your organization, IP space, devices, circuits and more.

The screenshots in this guide show NetBox populated with a small set of example objects. A freshly deployed instance starts empty, ready for you to model your own network.

Step 7 - Model your network: IPAM and DCIM

Open IPAM > Prefixes to record your IP space: aggregates, prefixes, IP ranges and individual addresses. Each can have a status, VRF, tenant, role and description. NetBox validates hierarchy and utilization automatically.

Open Devices to record your physical and virtual infrastructure: sites, racks, manufacturers, device types and the devices themselves. Devices carry roles, interfaces, cabling and console connections.

Step 8 - Use the REST API

NetBox exposes a complete REST API under /api/. To call any endpoint, send the token from /root/netbox-credentials.txt in the Authorization: Token <token> header.

Read the token into a shell variable, then query your devices and prefixes:

$
TOKEN=$(sudo grep '^NETBOX_API_TOKEN=' /root/netbox-credentials.txt | cut -d= -f2-) $ curl -s -H "Authorization: Token $TOKEN" http://<vm-ip>/api/dcim/devices/ count=2 - sw-access-01 @ HQ - sw-access-02 @ DC1 $ curl -s -H "Authorization: Token $TOKEN" http://<vm-ip>/api/ipam/prefixes/ count=3 - 10.0.0.0/8 - 10.1.10.0/24 - 192.168.1.0/24

A GraphQL endpoint is also available at /graphql/. To create additional scoped tokens, open Admin > API Tokens in the web UI.

Step 9 - Enable HTTPS with your own domain

NetBox ships on plain HTTP on port 80, so it works immediately. For production, point a DNS record at the VM's public IP. Add the hostname to ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS in /opt/netbox/netbox/netbox/configuration.py, then terminate TLS with a certificate.

A common approach is to obtain a certificate with certbot and reverse proxy through nginx. Alternatively, place Azure Application Gateway in front of the VM.

Restart the application after you edit the configuration:

$
sudo systemctl restart netbox netbox-rq

Administration and support

The NetBox manage.py command is wrapped for convenience. Run sudo netbox-manage <command>, for example sudo netbox-manage createsuperuser to add another administrator, or sudo netbox-manage housekeeping to run maintenance on demand.

The application configuration lives in /opt/netbox/netbox/netbox/configuration.py. Restart NetBox and its request queue worker with sudo systemctl restart netbox netbox-rq.

This image is a repackaged open-source software product, with additional charges for SecureAnyCloud support services. Our engineers provide 24/7 support for deployment, upgrades, TLS termination, LDAP and SSO integration, API automation and scaling.

NetBox is a trademark of its respective owner. The name is used here only to identify the software this image packages.

Deploy on Azure

Launch NetBox on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com