🚨 OpenStack Error Guide: 'SubnetInUse: One or more ports have an IP allocation' — Free the Subnet

Overview

SubnetInUse is the Neutron error raised when you try to delete a subnet (or the network containing it) while ports still hold IP allocations from that subnet. Neutron refuses to orphan those allocations, so the delete fails until every port on the subnet is removed or detached. This blocks tenant cleanup, Heat stack deletes, and Terraform destroys.

The literal errors you will see:

Conflict (HTTP 409) (Request-ID: req-2b8c...): Unable to complete operation on subnet 7f2a1c9d-4e5b-46a0-9c11-8de3a1b2c3d4. One or more ports have an IP allocation from this subnet.

neutronclient.common.exceptions.Conflict: Unable to complete operation on network 3c1d... There are one or more ports still in use on the network, id: 3c1d...

It appears on openstack subnet delete, openstack network delete, or a Heat/Terraform teardown that reaches the subnet before all its consumers are gone. The cause is always the same: something still owns an IP on that subnet.

Symptoms

• openstack subnet delete <id> or network delete <id> fails with HTTP 409 SubnetInUse / “ports still in use”.
• Heat stack DELETE_FAILED on a OS::Neutron::Subnet or OS::Neutron::Net resource.
• Terraform destroy hangs or errors on the subnet/network resource.
• A tenant “won’t clean up” even after instances appear deleted.

openstack subnet delete 7f2a1c9d-4e5b-46a0-9c11-8de3a1b2c3d4

Failed to delete subnet with name or ID '7f2a1c9d-...':
Unable to complete operation on subnet 7f2a1c9d-... One or more ports have an IP allocation from this subnet.

Common Root Causes

1. Router interface still attached

A router port on the subnet is the most common holdout — subnet delete won’t remove it; you must router remove subnet first.

openstack port list --network <net-id> \
  --device-owner network:router_interface -c ID -c "Fixed IP Addresses" -c "Device ID"

| a1b2... | ip_address='10.0.0.1' | <router-id> |   # gateway port

2. DHCP agent ports

Each DHCP-enabled subnet holds one or more network:dhcp ports. These usually clear when the network is deleted, but a stuck agent can leave them behind.

openstack port list --network <net-id> --device-owner network:dhcp -c ID -c Status

3. Instance (compute) ports still bound

VM ports (compute:nova / compute:<az>) mean an instance — possibly one stuck in deleting or error — still holds an IP.

openstack port list --network <net-id> --device-owner compute:nova \
  -c ID -c Status -c "Device ID"
openstack server list --all-projects --host '' -c ID -c Name -c Status | head

| c3d4... | ACTIVE | <server-id> |   # instance not actually gone

4. Floating IP / DNAT and load-balancer ports

Octavia VIP ports (Octavia), floating-IP ports, or router gateway ports on an external subnet pin the subnet.

openstack port list --network <net-id> \
  -c ID -c "Device Owner" -c Status | sort -k2
openstack floating ip list --network <net-id> 2>/dev/null

5. Orphaned / manually created ports

Ports created directly (port create) or left behind by a failed orchestration have device_owner empty and no server — nothing auto-cleans them.

openstack port list --network <net-id> -c ID -c "Device Owner" -c Status \
  | awk -F'|' '$3 ~ /^ *$/'

6. Ports stuck because the instance is stuck deleting

If Nova can’t finish deleting an instance (libvirt/RPC issue), its port lingers and blocks the subnet. Fixing the stuck instance is the real fix.

openstack server show <server-id> -c status -c fault
docker logs nova_compute 2>&1 | grep -i <server-id> | tail -10

Diagnostic Workflow

Step 1: List every port on the network, grouped by owner

openstack port list --network <net-id> \
  -c ID -c "Device Owner" -c Status -c "Fixed IP Addresses" | sort -k2

This is the master list — every row is something you must remove or detach before the subnet deletes.

Step 2: Handle router interfaces first

# Identify the router owning the interface, then detach the subnet
openstack port show <router-port-id> -c device_id
openstack router remove subnet <router-id> <subnet-id>

Step 3: Chase compute ports back to instances

openstack port show <compute-port-id> -c device_id
openstack server show <device-id> -c status -c fault

If the server exists, delete it normally. If it’s stuck, resolve the stuck-delete (see Step 5) rather than force-deleting the port under a live VM.

Step 4: Remove floating IPs / LB VIPs

openstack floating ip list --port <port-id>
openstack floating ip delete <fip-id>      # or disassociate
# Octavia VIP: delete the load balancer, don't force the port
openstack loadbalancer list --project <project-id>

Step 5: Deal with stuck instances behind lingering ports

openstack server show <server-id> -c status
docker logs nova_compute 2>&1 | grep -i <server-id> | tail -20
# Only after confirming the VM is truly gone from the hypervisor:
openstack server delete <server-id>

Step 6: Delete only truly orphaned ports, then the subnet

# Confirm no device_id and no live consumer, then remove
openstack port delete <orphan-port-id>
openstack subnet delete <subnet-id>

Example Root Cause Analysis

Terraform destroy fails to delete a tenant network:

Error: Unable to complete operation on subnet 7f2a1c9d-... One or more ports have an IP allocation from this subnet. (HTTP 409)

List the ports:

openstack port list --network 3c1d... -c ID -c "Device Owner" -c Status | sort -k2

| a1b2... | network:router_interface | ACTIVE |
| e5f6... | compute:nova             | ACTIVE |

Two holdouts: a router interface and a compute port. The compute port maps to an instance Terraform thought it deleted:

openstack port show e5f6... -c device_id
openstack server show <server-id> -c status -c fault

status | ERROR
fault  | ... libvirt ... during delete

The instance is stuck in ERROR from a failed delete, so its port never freed, which blocks the subnet, which blocks Terraform. Fix in order — resolve the stuck instance, detach the router, then delete:

docker logs nova_compute 2>&1 | grep -i <server-id> | tail   # confirm domain gone
openstack server delete <server-id>                          # port frees
openstack router remove subnet <router-id> 7f2a1c9d-...      # detach gateway
openstack subnet delete 7f2a1c9d-...                         # now succeeds

Root cause: a stuck instance delete left a compute port holding an IP; the router interface compounded it. The SubnetInUse error was a symptom two layers up from the real problem.

Prevention Best Practices

• Tear down in dependency order: instances and floating IPs/LBs → router-interface detach → subnet → network. Heat/Terraform normally encode this; failures usually mean a stuck resource, not bad ordering.
• Alert on instances stuck in ERROR/deleting; their lingering ports are a common SubnetInUse cause.
• Before deleting a network, run openstack port list --network <net-id> and clear the list first, so the failure is explicit rather than a mystery 409.
• Never blind-port delete ports under live instances or LBs to “win” the delete — you strip networking from a running workload. Fix the owner instead.
• Use Octavia/router APIs to remove VIP and gateway ports; don’t delete their ports directly.
• Sweep for orphaned ports (empty device_owner, no device_id) periodically as part of tenant cleanup.
• For a quick teardown-order sanity check, drop the port list and error into the free incident assistant, and browse more OpenStack guides.

Quick Command Reference

# The master list: everything holding the subnet
openstack port list --network <net-id> -c ID -c "Device Owner" -c Status -c "Fixed IP Addresses" | sort -k2

# Router interface (most common holdout)
openstack port show <router-port-id> -c device_id
openstack router remove subnet <router-id> <subnet-id>

# Compute ports -> instances
openstack port show <compute-port-id> -c device_id
openstack server show <device-id> -c status -c fault

# Floating IPs / load balancers
openstack floating ip list --port <port-id>
openstack floating ip delete <fip-id>
openstack loadbalancer list --project <project-id>

# Stuck instance behind a lingering port
docker logs nova_compute 2>&1 | grep -i <server-id> | tail -20
openstack server delete <server-id>

# Only truly orphaned ports, then the subnet
openstack port delete <orphan-port-id>
openstack subnet delete <subnet-id>

Conclusion

SubnetInUse means Neutron won’t delete a subnet because ports still hold IP allocations from it. The fix is never to force the subnet delete — it’s to find and clear the port owners in the right order:

1. Router interfaces (detach with router remove subnet).
2. DHCP agent ports.
3. Instance/compute ports — often a VM that’s stuck in deleting/ERROR.
4. Floating-IP and Octavia VIP ports.
5. Orphaned, ownerless ports from failed orchestration.
6. Stuck instance deletes that keep a port pinned.

Start with openstack port list --network <net-id>; that list is your work queue. When a compute port won’t free, the real bug is usually a stuck instance one layer up — fix that, and the subnet deletes cleanly.