Console user manual

Who this is for: operators, helpdesk, and anyone who is given a Lattice token and told to “look something up” or “give the printer a fixed IP.” You do not install the product. You do not SSH to the VMs. You work in the browser console.

Companion: Administrator. Topic pages: Docs home. In-console recipes: Help.

1. What you are looking at

Lattice is the company’s IP address manager and DHCP server (and, depending on how it was installed, DNS for internal zones).

Two ideas, used all day:

• Intent — the addressing plan: prefixes, subnets, pools, reservations, assignments, excludes. Admins write most of this; operators can add reservations and assignments.
• Reality — leases: what dhcpd actually handed to a device.
• Work — queues that prove the plan is a lie. Lattice never auto-reclaims.

There is no checkbox named “used.” If you need an address to mean something, pick the object that matches the intent (section 6).

The screen refreshes itself. Overview counts and alerts come from the database every eight seconds, not from a single DHCP box.

2. Sign in

1. Open the console URL your admin gave you (https:// the host or VIP — browser warning is the self-signed cert). Never latticeddi.com — that site is download + entitlement, not this console. Do not use http://127.0.0.1:8080 from a laptop after lattice-install.
2. If SSO is enabled, Sign in with SSO. Otherwise paste an API token that starts with lattice_live_.
3. You are in. Scripts still use tokens.

The first time (empty install)

lattice-install already minted the first admin and wrote /etc/lattice/bootstrap.token. Paste that. If the table is empty and you are on the server, the login screen can mint (loopback only). Copy the secret once. Then use Enter console.

If you lost the token

You cannot recover it. Closing the tab is not a lost token — paste /etc/lattice/bootstrap.token again. An admin mints a new one under Tokens. If the table is empty again, mint on the server. Do not email tokens. Do not put them in tickets, chat, or screenshots.

What the browser does with the secret

The token lives in this tab only (memory + sessionStorage). A new tab does not inherit it. Closing the tab forgets it. Bookmarking does not save it. Treat it like a password you have to paste each session.

3. What your role can do

Your name and role are in the top-right (you · operator).

If a button is missing, you are not allowed. If you paste a request into curl anyway, the API returns 403. Hiding the button is not the security boundary; the server is.

Escalate to an admin when you need a new subnet, a bigger pool, a DNS adapter change, a new token, or a license file.

4. The header

Left: Lattice mark (home). Primary nav: Overview · Addresses · Leases · Work · DNS. More holds Cluster, Settings, Audit, History, License, and admin screens. Help sits with your session on the right.

Search (IP, MAC, hostname, CIDR, DNS name): type in the header, or press Cmd-K / Ctrl-K. Hits open the object. Cisco dotted MAC works. Use this before opening Leases if you have a full identifier. Occupancy over time is More → History.

Sign out drops the token from this tab.

5. Overview

Home. You should be able to answer, in one glance:

• Is the API up? (ok / down)
• Is it ready for traffic? (Ready)
• How many dhcpd nodes are heartbeating?
• Is DNS falling behind? (Outbox lag, Dead letters)
• How many addresses are leased vs free?
• Are we near the license cap?

Alerts are colour-coded. Click one to jump (pool full → subnet, license → License, and so on).

Subnet utilization — click a CIDR to open the subnet. The bar is leased / reserved / excluded.

dhcpd nodes — a stale badge means no heartbeat for about a minute. That node is not taking work. Tell an admin; do not reboot boxes yourself unless that is your job.

Recent leases / Recent IPAM changes — last activity. Audit is “who changed the plan,” not “who got an IP.”

6. How to mark an address

This is the most important table in the product. Lattice will not invent a fourth object for you.

Reservations (operators can do this)

1. Plan → open the subnet, or search the IP / MAC.
2. Reservations → IP, MAC (aa:bb:cc:dd:ee:ff), optional client-id, DUID (IPv6), hostname, note.
3. Save.

After this:

• That device always gets this IP (in this subnet).
• Nobody else gets this IP from DHCP.
• It counts toward the license cap (leased + reserved + quarantined + assigned).

If the device already has a dynamic lease on a different address, force-release the old lease (or wait for expiry) so it will Discover into the reservation.

You cannot reserve an address inside an exclude. You cannot reserve an address another reservation already holds. The API will say conflict or validation.

Excludes (admin)

Infrastructure holes: gateway, load-balancer VIP, an old printer someone numbered by hand in 2014. DHCP will never Offer them. They do not count as managed IPs.

If you are an operator and you need an exclude, ask an admin. Do not “reserve” a gateway to a fake MAC — that still counts against the license and implies DHCP should serve it.

7. Plan (read the map)

Addresses (/plan) is the addressing tree: prefixes (the blocks on the drawing) and subnets (the L3 networks Lattice may serve).

• A prefix can exist without ever being a DHCP scope.
• A subnet without a pool will not hand out addresses.
• Utilization on the subnet row is leased vs free.

Admins add prefixes and subnets here. Operators look, then Open a subnet to work reservations and leases.

If you have more than one tenant, admins can filter the plan by tenant. You will usually live on default.

8. The subnet page

Opened from Plan, Overview, or search. Title is the CIDR.

Utilization — size, leased, reserved, excluded, free.

Settings and DDNS — gateway, VLAN, site, VRF, lease time, T1/T2, NTP (option 42 for clients), PXE next-server / boot file, DDNS adapter. Admin writes. Lease time defaults to 1 day; leave T1/T2 blank (RFC 50% / 87.5%) unless you have a reason (DHCP lease time). If you are operator, this is documentation of how the network is supposed to behave.

Pools — the dynamic range. “PD” is IPv6 prefix delegation; blank means ordinary addresses. Admin enable/disable/delete.

Reservations — your main write surface if you are operator.

Excludes — admin.

DHCP options — extra codes (DNS servers, domain name, vendor). JSON payload. Admin. Mask, router, and lease-time are already built-in from the subnet; do not duplicate them unless you know why.

Leases in this subnet — live rows. Operator/admin can Release (confirm).

9. Leases (helpdesk)

Leases is the shared lease store. Filter by subnet, IP, MAC, hostname, client-id, state.

States you will see:

Find a MAC

1. Search in the console, or Leases → MAC aa:bb:cc:dd:ee:ff → Search.
2. Open the row if you need hostname, FQDN, which node granted it, relay giaddr.

Force-release

Use this when:

• The device was replaced and the old MAC still holds the address.
• Helpdesk needs the IP back in the pool now, not at expiry.
• You reserved .10 and the old dynamic lease is still on .55.

Click Release → Confirm. Inventory returns to free (or to reserved, if a reservation covers it). DNS delete is queued. The name may linger for seconds to minutes if the DNS adapter is slow. That is expected. DHCP Ack never waited on DNS in the first place.

Readonly users can search. They cannot release.

Do not force-release as a substitute for shrinking a pool or fixing a mis-set reservation. Do not release a printer you just reserved unless you mean it.

10. Search

Type an IP, MAC, hostname, CIDR, or DNS name. Hits say what kind of object they are. Follow the link. A full MAC also loads the timeline. Occupancy over time is History.

If search is empty: the identifier is wrong, the object is in another tenant you cannot see, or it was never created. Try Leases with fewer filters. Ask an admin to confirm the subnet exists.

11. DNS (looking, not editing unless admin)

DNS is lattice-dns: authoritative names for Lattice-managed internal zones. Recursion is off. This is not “the internet DNS” and not Active Directory’s forest.

You will see:

• Zones (SOA/NS)
• Lease-derived A/AAAA for names in this zone (from state=leased). Expire or release removes them (NXDOMAIN after the worker runs).
• Static records (admin): printers and VIPs that are not DHCP.

If names are missing after a laptop got an IP:

1. Overview → outbox lag / dead letters. If lag is climbing, DNS is behind. The lease is still valid.
2. Subnet → DDNS enabled? Adapter set? Forward/reverse zones filled in?
3. Tell an admin. Do not toggle adapters yourself unless you are admin and you know the zone’s mode.

One adapter per zone. Mixing AD, BIND, and lattice-dns on the same zone splits the brain. Admins configure adapters under DDNS.

12. Nodes, Cluster, License (what to tell an admin)

Nodes — dhcpd heartbeats. Stale = that process has not checked in. Two (or more) healthy names is normal. Postgres is the HA fabric; you do not fail over DHCP by hand.

Cluster — dhcpd heartbeats are always at the top, Community included. Two (or more) healthy names is normal. These nodes are serving; a failover VIP is Starter+. Postgres is the HA fabric; you do not fail over DHCP by hand. Extra dhcpd in another subnet or DC is an admin install (dhcp-only); a DR site is restore then cut relays, not a stretched VIP. Paid HA (VIP, Patroni, backups) is further down when licensed. Community shows an upgrade note there, not an installer. You cannot join a node from this page. Join secrets are printed on the server at install time, not here. HA.

License — used / cap. Used is leased + reserved + quarantined + assigned. If it says renew only, existing devices keep their IPs; new grants, reservations, and assignments fail until an admin uploads a new lattice.entitlement.json. Do not edit the JSON by hand; that breaks the signature and drops the site to community (1,000 IPs).

13. Audit and History

Audit is who changed the plan: create prefix, delete pool, mint token, force-release, and so on. Newest first. Before/after JSON is on the row. Search (q) looks through that JSON — “who reserved .10?” belongs here.

History (More → History) is occupancy: who held this IP and for how long, which subnets this MAC has been on, which MACs this hostname used (a laptop that changed NIC), a client-id / DUID, or a switch port (Gi1/0/12 option 82 circuit-id). Paste the identity — Lattice detects IP vs MAC vs hostname vs hex vs a port with a slash. A remote-id looks like a hostname; use ?remote= on the URL. Optional relay giaddr narrows a port that exists in more than one building. Relays must send option 82; otherwise the empty sentence says so. As of a timestamp (or a calendar date = that whole day on this computer) answers “who had .55 last Tuesday.” From/to clips the list. Source is lease rows (live and expired/released) — Lattice does not prune them. NAK/silent for this IP/MAC/port (last 7 days) and Audit hits sit on the same page. Current reservation/assignment/exclude is plan, not a hold. CSV is the hold table (option 82, relay, node hop included). Last occupant on the address map is only the latest free-IP row — History is the full list. History.

The whole subnet last Tuesday is As of on the subnet address map (not History paste of a CIDR). The map is who held each address at the end of that day (now, if you pick today). Occupancy is lease rows; reservations/assignments/excludes on that map are the current plan. CSV is still that day’s hold table.

If someone asks “who had 10.20.20.55 last Tuesday?”, use History, not Audit. If they ask “what was on vlan 20 last Tuesday?”, open the subnet and use As of. If they ask “who reserved .10?”, use Audit.

14. Classes, webhooks, NetBox, tenants, tokens

These are admin screens. As operator/readonly you may see some of them as read-only, or not at all.

• Classes — match vendor-class / user-class / MAC prefix; steer a pool. You do not need this for a single printer reservation.
• Webhooks — signed HTTP posts of lease and audit events. Secrets are refs, not shown.
• NetBox — Lattice owns DHCP objects. Import only creates missing prefixes.
• Tenants — operators cannot list them. You work in whatever tenant the admin put the subnet in.
• Tokens — admin only. If you need a token, ask. If you had one and it was revoked, ask again.

15. Recipes

A. “What IP does this MAC have?”

Search the MAC, or Leases → MAC → Search. Note state (leased vs expired). Click through to the subnet if you need VLAN/site. Who held it last week, or which NICs this hostname used: History.

B. “Give this printer 10.20.20.10 forever”

1. Confirm .10 is not the gateway (that should be an exclude).
2. Subnet → Reservations → IP + MAC (+ hostname if you have a naming standard).
3. If the printer already has another lease, force-release it and renew/reboot the printer.

C. “The pool looks full / nobody gets an address”

1. Overview / subnet utilization: free vs leased vs reserved vs excluded vs quarantined.
2. Search quarantined. They free after the quarantine timer; you can also ask an admin.
3. Force-release abandoned MACs (old imaging carts, duplicate test VMs).
4. If free is actually 0, you need an admin to expand the pool. You cannot grow a pool as operator.

Silence (no Offer at all) is usually relay/giaddr/no pool/dhcpd down — that is an admin ticket, not a reservation ticket.

D. “The name in DNS is stale”

1. Confirm the lease still exists and the hostname/FQDN on the lease is what you expect.
2. Overview outbox lag.
3. Admin: adapter, worker running, BIND/AD reachable.

E. “PXE is not booting”

PXE next-server and boot file are subnet fields, not a reservation checkbox. Admin. Server-id (option 54) is not the TFTP server.

F. “IPv6”

Reservations can take a DUID. PD (prefix delegation) is a pool setting (PD len). You do not explode a /64. Ask an admin to add the v6 subnet/pool; then reserve as usual.

16. Help and human support

Help in the console is short recipes plus links to latticeddi.com. It does not install nodes and it does not print join tokens.

External support (if your contract has it): tickets and [email protected]. Business hours America/Chicago. No phone. No 24×7.

When you file a ticket, include: the console URL, your role, the subnet CIDR, the MAC/IP, a screenshot of Overview (alerts + outbox lag), and what you already tried (search, release, reservation). Do not paste lattice_live_… tokens.

17. Things that look like bugs but are not

• Discover hit dhcp-a and Ack came from dhcp-b. Normal. One database.
• DNS still shows the old name 20 seconds after release. Outbox is asynchronous.
• Community Cluster page talks about paid HA and does not give you commands with 10.0.0.10. Status only; installer is on the VM.
• A new browser tab asks you to sign in again. Token is tab-scoped on purpose.
• License “renew only” and existing phones still work. That is the product rule: never crash DHCP to enforce a cap.