What is the single most important IPAM practice?

Recording an assignment at the moment it is made, not afterwards. Every other practice depends on the data being current, and records written later are the ones that never get written.

What utilization threshold should trigger action?

Around 80% of an aggregate. Acquiring and routing new space takes weeks, and consumption accelerates as a network grows, so the last 20% is consumed faster than the first 80% suggests.

How often should IPAM records be reconciled against reality?

Continuously for anything automated, and at least quarterly for the rest. Reconciliation finds addresses in use that were never recorded and records for things that no longer exist.

Should IPAM be the source of truth or a reflection of the network?

The source of truth. If provisioning reads from IPAM, records stay accurate because they have to be. If IPAM only documents what was already built, it drifts within months.

Who should be allowed to assign addresses?

Anyone who needs to, through the tool. Restricting assignment to a small group creates a bottleneck that people route around during incidents, and out-of-band assignments are exactly what corrupts the data.

IPAM Best Practices

Reviewed by Marek Dvořák, Network engineer

An IPAM system fails in one way: the records stop matching reality. Every practice below exists to prevent that, and they are listed roughly in order of how much damage their absence causes.

Record at assignment time

The record has to be created when the address is assigned, by the person assigning it. Not at the end of the change, not in the following week’s cleanup.

This is not a discipline problem, it is a workflow problem. Addresses get assigned during incidents and deployments, when documenting is the last priority. The fix is to make assignment through the tool the fastest path — faster than picking an address from memory and moving on. If the tool is slower than guessing, it will lose, and the data will rot no matter what the policy says.

The practical test: can an engineer at 3am get a free address from IPAM in under thirty seconds? If not, that is the problem to solve first.

Make IPAM the source of truth, not documentation

The difference is whether anything reads from it.

If provisioning, monitoring, firewall generation, or DNS pull from the IPAM API, the records must be correct or things break immediately. That feedback loop is what keeps data accurate. If nothing reads from it, errors are invisible until someone trips over them a year later.

This is the strongest argument for a tool with a usable API over a spreadsheet, and it is worth wiring up even one consumer early. See the tools reference for what each option exposes.

Use roles and tags, not descriptions

Free-text descriptions cannot be queried. A field called role with a fixed set of values can.

Keep the role list short and stable — something like management, customer, infrastructure, point-to-point, loadbalancer, reserved. Resist the urge to add a role per project; projects end and the role list becomes a graveyard.

The payoff arrives when someone asks a question you did not anticipate: which space is customer-facing, how much management space is left, which ranges need to appear in a particular firewall policy. With roles those are queries. With descriptions they are a manual review.

Set a utilization threshold and mean it

Track utilization per aggregate, not just overall. An estate at 60% overall can have a site at 98%.

Act at around 80%. The reasoning is timing rather than tidiness: acquiring routable space involves negotiation, registry transfer, and routing setup, which together take weeks. Consumption also accelerates — a network that grew 20% last year is adding more addresses per month than it was, so the remaining 20% lasts less time than the arithmetic suggests.

Count reserved space as used when calculating this. Space you have promised to a project is not available, and treating it as free is how you discover a shortage on the day of a deployment.

Reconcile records against reality

Records drift regardless of policy. Reconciliation finds the drift.

Two directions matter. Addresses in use that are not recorded indicate assignments made outside the process; each one is a future conflict. Records for things that no longer exist inflate utilization and hide free space.

How you reconcile depends on the tool. phpIPAM scans by default and shows discovered-versus-recorded directly. NetBox does not scan, so reconciliation is an external script comparing the API against a discovery source. Neither approach is wrong, but the scan-first tool makes the gap visible without extra work, and the source-of-truth tool makes intent explicit. Know which one you chose.

Quarterly is a reasonable floor for anything not automated.

Have a decommission process

Deployments are documented because someone is watching. Decommissions are not, because by then everyone has moved on.

The result is an estate where a growing fraction of recorded assignments belong to services that were turned off years ago. Utilization looks high, free space looks scarce, and the pressure to acquire more addresses is manufactured.

Make address release part of the decommission checklist, with a holding period rather than immediate reuse. Marking a block deprecated for a quarter before returning it to the pool catches the case where something was still using it.

Keep registry records in step

For space you hold from a registry, your internal records and the registry’s must agree. Registries expect assignment data to be published and accurate, and the check usually arrives when you request more space — the worst possible moment to discover a discrepancy.

This is a distinct workflow from internal IPAM and is covered in utilization and RIR audits.

Do not restrict who can assign

Limiting assignment rights to a small team seems like a control. In practice it creates a queue, and people under time pressure route around queues. The addresses still get assigned; they just stop being recorded.

Let anyone who needs an address get one through the tool, and use roles, approval workflows, and audit trails to maintain control instead. An assignment you can see and question is better than one you cannot.

What is IPAM — scope and failure modes
Address plan design — the structure these practices maintain
IPAM tools reference — which tools support which practices
IPAM for leased space — the additional records leased blocks require

Last updated on August 29, 2026

Address plan design Tools reference