Duplicate Alert

Unanswered Question
Nov 19th, 2008

My LMS version is 3.0.1. Running on Windows System. I received duplicate alert. Duplicate 157.47.249.1/[157.47.224.13]. There is device with IP Address 157.47.224.13, then the loopback interface is 157.47.249.1. How to fix it? I have cleared the alerd,after re-integrated with ACS, the alert appears again.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Verify Same IP address is configured on multiple managed systems. When different IP addresses belonging to the same device are added as separate devices, due to a timing issue, they are discovered and listed as separate devices. This is incorrect and causes invalid Duplicate IP alarms. There is no workaround. Then this is bug


Martin Ermel Fri, 11/28/2008 - 03:26

please post the details of both alerts you think are duplicates;

do you get duplicate notifications or do you see them in the 'Alerts And Acitivity Display' (AAD) of DFM?

Martin Ermel Fri, 11/28/2008 - 05:47

DFM is often the cause of discussions, but with 'Duplicate IP' events it was right in every situation I saw this event. The easiest thing to verify these events is to telnet to both the devices reporting the duplicate and issue the command 'sh ip inter brief | incl 157.47.224.13'. I bet you get a match on both devices.

The most common cause is that you have an interface with this IP on 2 devices, whereas only one is active and the other is down or unconnected. DFM reports this event even if there is a down interface which hasan IP yet configured on another devcice just to inform you of the possible risk of this configuration.

In your situation '157.47.224.13' seems to be configured on 157.47.249.1 AND on 167.96.2.26. So check both these devices for this IP address.


riko.arizona Tue, 12/02/2008 - 01:43

IP 157.47.224.13 (Device -A), IP 157.47.249.1 (interface loopback 0 of Device -A), IP 167.96.2.26 (interface Tunnel0 of device -A. I have run the command 'sh ip inter brief | incl 157.47.224.13' on device vlan-lip-atm.tpra.fmi.com, but there is no ip 157.47.224.13. How to get it fixed?



Attachment: 
Martin Ermel Fri, 12/12/2008 - 07:28

sorry for the delay;

mistake from my side; your duplicate IP is 167.96.2.26 and not 157.47.224.13. Click on the event ID of your duplicate event [00010R0]. In the event details you will see 'DuplicatedBySystems' which lists the devices which have both configured the IP in question. Connect to the devices and issue the command 'show ip interface brief' (for the case the pipe command is not supported). Look for '167.96.2.26'.

I am sure you will find this IP on all the device listed in 'DuplicatedBySystems'.


riko.arizona Tue, 12/16/2008 - 04:54

I have run 'show ip interface brief', but I can't find 157.47.249.1 or 157.47.224.13 or 167.96.2.26.

Martin Ermel Tue, 12/16/2008 - 08:20

could you please post a screenshot of the Event Details of 00010R0 and 00010R1; - click on the mentioned EventID in the 'Alerts and Activites Detail' screen to get the details;

We are facing a similar issue.Can you please confirm that is it possible to get E-mail notifications for this Duplicate event ??Or we can simply get alerts on LMS for the same but no such notifications.Also explain the correct description of the event code :1001.I understand it detects the duplicate IP Adresses that come into the network.



vaibhav-g Fri, 01/09/2009 - 02:34

Hi Team


We are facing a similar issue.Can you please confirm that is it possible to get E-mail notifications for this Duplicate event ??Or we can simply get alerts on LMS for the same but no such notifications.Also explain the correct description of the event code :1001.I understand it detects the duplicate IP Adresses that come into the network.




Regards

Vaibhav

Actions

This Discussion