Console user manual

Who this is for: operators, helpdesk, and anyone who is given a Lattice token and told to “look something up” or “give the printer a fixed IP.” You do not install the product. You do not SSH to the VMs. You work in the browser console.

Companion: Administrator. Topic pages: Docs home. In-console recipes: Help.

1. What you are looking at

Lattice is the company’s IP address manager and DHCP server (and, depending on how it was installed, DNS for internal zones).

Two ideas, used all day:

• Intent — the addressing plan: prefixes, subnets, pools, reservations, excludes. Admins write most of this.
• Reality — leases: what dhcpd actually handed to a device.

There is no checkbox named “used.” If you need an address to mean something, pick the object that matches the intent (section 6).

The screen refreshes itself. Overview counts and alerts come from the database every eight seconds, not from a single DHCP box.

2. Sign in

1. Open the console URL your admin gave you (lab: http://127.0.0.1:8080/; production HA: https:// the VIP or DNS name).
2. Paste an API token that starts with lattice_live_.
3. You are in.

The first time (empty install)

If nobody has created a token yet, the login screen offers Create admin token. That is for the person installing Lattice. Copy the secret once. It will not be shown again. Then use Enter console.

If you lost the token

You cannot recover it. An admin mints a new one under Tokens. If the token table is empty again, the login screen can mint the first admin. Do not email tokens. Do not put them in tickets, chat, or screenshots.

What the browser does with the secret

The token lives in this tab only (memory + sessionStorage). A new tab does not inherit it. Closing the tab forgets it. Bookmarking does not save it. Treat it like a password you have to paste each session.

3. What your role can do

Your name and role are in the top-right (you · operator).

If a button is missing, you are not allowed. If you paste a request into curl anyway, the API returns 403. Hiding the button is not the security boundary; the server is.

Escalate to an admin when you need a new subnet, a bigger pool, a DNS adapter change, a new token, or a license file.

4. The header

Left: Lattice mark (home). Primary nav: Overview, Plan, Leases, DNS, and (if you are admin) more. Help sits with your session on the right.

Search (IP, MAC, hostname): type and submit. Results open the subnet, plan, or DNS as appropriate. Use this before opening Leases if you have a full identifier.

Sign out drops the token from this tab.

5. Overview

Home. You should be able to answer, in one glance:

• Is the API up? (ok / down)
• Is it ready for traffic? (Ready)
• How many dhcpd nodes are heartbeating?
• Is DNS falling behind? (Outbox lag, Dead letters)
• How many addresses are leased vs free?
• Are we near the license cap?

Alerts are colour-coded. Click one to jump (pool full → subnet, license → License, and so on).

Subnet utilization — click a CIDR to open the subnet. The bar is leased / reserved / excluded.

dhcpd nodes — a stale badge means no heartbeat for about a minute. That node is not taking work. Tell an admin; do not reboot boxes yourself unless that is your job.

Recent leases / Recent IPAM changes — last activity. Audit is “who changed the plan,” not “who got an IP.”

6. How to mark an address

This is the most important table in the product. Lattice will not invent a fourth object for you.

Reservations (operators can do this)

1. Plan → open the subnet, or search the IP / MAC.
2. Reservations → IP, MAC (aa:bb:cc:dd:ee:ff), optional client-id, DUID (IPv6), hostname, note.
3. Save.

After this:

• That device always gets this IP (in this subnet).
• Nobody else gets this IP from DHCP.
• It counts toward the license cap (leased + reserved + quarantined).

If the device already has a dynamic lease on a different address, force-release the old lease (or wait for expiry) so it will Discover into the reservation.

You cannot reserve an address inside an exclude. You cannot reserve an address another reservation already holds. The API will say conflict or validation.

Excludes (admin)

Infrastructure holes: gateway, load-balancer VIP, an old printer someone numbered by hand in 2014. DHCP will never Offer them. They do not count as managed IPs.

If you are an operator and you need an exclude, ask an admin. Do not “reserve” a gateway to a fake MAC — that still counts against the license and implies DHCP should serve it.

7. Plan (read the map)

Plan is the addressing tree: prefixes (the blocks on the drawing) and subnets (the L3 networks Lattice may serve).

• A prefix can exist without ever being a DHCP scope.
• A subnet without a pool will not hand out addresses.
• Utilization on the subnet row is leased vs free.

Admins add prefixes and subnets here. Operators look, then Open a subnet to work reservations and leases.

If you have more than one tenant, admins can filter the plan by tenant. You will usually live on default.

8. The subnet page

Opened from Plan, Overview, or search. Title is the CIDR.

Utilization — size, leased, reserved, excluded, free.

Settings and DDNS — gateway, VLAN, site, VRF, lease time, T1/T2, NTP (option 42 for clients), PXE next-server / boot file, DDNS adapter. Admin writes. If you are operator, this is documentation of how the network is supposed to behave.

Pools — the dynamic range. “PD” is IPv6 prefix delegation; blank means ordinary addresses. Admin enable/disable/delete.

Reservations — your main write surface if you are operator.

Excludes — admin.

DHCP options — extra codes (DNS servers, domain name, vendor). JSON payload. Admin. Mask, router, and lease-time are already built-in from the subnet; do not duplicate them unless you know why.

Leases in this subnet — live rows. Operator/admin can Release (confirm).

9. Leases (helpdesk)

Leases is the shared lease store. Filter by subnet, IP, MAC, hostname, client-id, state.

States you will see:

Find a MAC

1. Header search, or Leases → MAC aa:bb:cc:dd:ee:ff → Search.
2. Open the row if you need hostname, FQDN, which node granted it, relay giaddr.

Force-release

Use this when:

• The device was replaced and the old MAC still holds the address.
• Helpdesk needs the IP back in the pool now, not at expiry.
• You reserved .10 and the old dynamic lease is still on .55.

Click Release → Confirm. Inventory returns to free (or to reserved, if a reservation covers it). DNS delete is queued. The name may linger for seconds to minutes if the DNS adapter is slow. That is expected. DHCP Ack never waited on DNS in the first place.

Readonly users can search. They cannot release.

Do not force-release as a substitute for shrinking a pool or fixing a mis-set reservation. Do not release a printer you just reserved unless you mean it.

10. Search

Type an IP, MAC, hostname, CIDR, or DNS name. Hits say what kind of object they are. Follow the link.

If search is empty: the identifier is wrong, the object is in another tenant you cannot see, or it was never created. Try Leases with fewer filters. Ask an admin to confirm the subnet exists.

11. DNS (looking, not editing unless admin)

DNS is lattice-dns: authoritative names for Lattice-managed internal zones. Recursion is off. This is not “the internet DNS” and not Active Directory’s forest.

You will see:

• Zones (SOA/NS)
• Lease-derived A/AAAA for names in this zone (from state=leased). Expire or release removes them (NXDOMAIN after the worker runs).
• Static records (admin): printers and VIPs that are not DHCP.

If names are missing after a laptop got an IP:

1. Overview → outbox lag / dead letters. If lag is climbing, DNS is behind. The lease is still valid.
2. Subnet → DDNS enabled? Adapter set? Forward/reverse zones filled in?
3. Tell an admin. Do not toggle adapters yourself unless you are admin and you know the zone’s mode.

One adapter per zone. Mixing AD, BIND, and lattice-dns on the same zone splits the brain. Admins configure adapters under DDNS.

12. Nodes, Cluster, License (what to tell an admin)

Nodes — dhcpd heartbeats. Stale = that process has not checked in. Two (or more) healthy names is normal. Postgres is the HA fabric; you do not fail over DHCP by hand.

Cluster — paid three-node HA status (VIP, Patroni, backups). On community you will see an upgrade note, not an installer. You cannot join a node from this page. Join secrets are printed on the server at install time, not here.

License — used / cap. Used is leased + reserved + quarantined. If it says renew only, existing devices keep their IPs; new devices will not get Offers and new reservations will fail until an admin uploads a new lattice.entitlement.json. Do not edit the JSON by hand; that breaks the signature and drops the site to community (1,000 IPs).

13. Audit

Who changed the plan: create prefix, delete pool, mint token, force-release, and so on. Newest first. Before/after JSON is on the row.

Lease grants (the DHCP conversation) are not in Audit. Those are leases + outbox. If someone asks “who got 10.20.20.55?”, use Leases / search, not Audit. If they ask “who reserved .10?”, use Audit.

14. Classes, webhooks, NetBox, tenants, tokens

These are admin screens. As operator/readonly you may see some of them as read-only, or not at all.

• Classes — match vendor-class / user-class / MAC prefix; steer a pool. You do not need this for a single printer reservation.
• Webhooks — signed HTTP posts of lease and audit events. Secrets are refs, not shown.
• NetBox — Lattice owns DHCP objects. Import only creates missing prefixes.
• Tenants — operators cannot list them. You work in whatever tenant the admin put the subnet in.
• Tokens — admin only. If you need a token, ask. If you had one and it was revoked, ask again.

15. Recipes

A. “What IP does this MAC have?”

Search the MAC, or Leases → MAC → Search. Note state (leased vs expired). Click through to the subnet if you need VLAN/site.

B. “Give this printer 10.20.20.10 forever”

1. Confirm .10 is not the gateway (that should be an exclude).
2. Subnet → Reservations → IP + MAC (+ hostname if you have a naming standard).
3. If the printer already has another lease, force-release it and renew/reboot the printer.

C. “The pool looks full / nobody gets an address”

1. Overview / subnet utilization: free vs leased vs reserved vs excluded vs quarantined.
2. Search quarantined. They free after the quarantine timer; you can also ask an admin.
3. Force-release abandoned MACs (old imaging carts, duplicate test VMs).
4. If free is actually 0, you need an admin to expand the pool. You cannot grow a pool as operator.

Silence (no Offer at all) is usually relay/giaddr/no pool/dhcpd down — that is an admin ticket, not a reservation ticket.

D. “The name in DNS is stale”

1. Confirm the lease still exists and the hostname/FQDN on the lease is what you expect.
2. Overview outbox lag.
3. Admin: adapter, worker running, BIND/AD reachable.

E. “PXE is not booting”

PXE next-server and boot file are subnet fields, not a reservation checkbox. Admin. Server-id (option 54) is not the TFTP server.

F. “IPv6”

Reservations can take a DUID. PD (prefix delegation) is a pool setting (PD len). You do not explode a /64. Ask an admin to add the v6 subnet/pool; then reserve as usual.

16. Help and human support

Help in the console is short recipes plus links to latticeddi.com. It does not install nodes and it does not print join tokens.

External support (if your contract has it): tickets and [email protected]. Business hours America/Chicago. No phone. No 24×7.

When you file a ticket, include: the console URL, your role, the subnet CIDR, the MAC/IP, a screenshot of Overview (alerts + outbox lag), and what you already tried (search, release, reservation). Do not paste lattice_live_… tokens.

17. Things that look like bugs but are not

• Discover hit dhcp-a and Ack came from dhcp-b. Normal. One database.
• DNS still shows the old name 20 seconds after release. Outbox is asynchronous.
• Community Cluster page talks about paid HA and does not give you commands with 10.0.0.10. Status only; installer is on the VM.
• A new browser tab asks you to sign in again. Token is tab-scoped on purpose.
• License “renew only” and existing phones still work. That is the product rule: never crash DHCP to enforce a cap.