IPAM IP Address conflict - HSRP

10/26/2018 5:25 PM

7/17/2026 5:10 PM

IPAM is reporting some IP Conflict Alerts or Events on your HSRP (Hot Standby Router Protocol) that should not apply. 

Example:

   The IP address 10.15.7.254 is in conflict.
   The following devices were detected on network with same IP address: PingSweep vs Neighbor
   data (MAC: 10-8C-CF-20-08-41, MAC: 00-00-0C-9F-F3-CA)

IP Address Manager

This conflict message verifies IP conflicts based on the MAC address results of an IP from multiple sources. If 2 or more different IP sources report different MACs for the same IP: then it is flagged as a conflict. A specific IP address is configured as a gateway address for a vlan on multiple Cisco switches with the HSRP (Hot Standby Router Protocol) (Cisco proprietary redundancy protocol i.e. vrrp). Because of this setup, there are multiple MAC addresses that are using the same IP address.

 

There are three options for managing HSRP IP conflict noise in IPAM. Choose the approach that best fits the scale of your environment.

Option 1: Hide the Conflict in the IP Address Detail View (Recommended for individual IPs)

You can hide a conflict flag directly from the IP Address Details page without modifying any alert definitions.

1. Navigate to My Dashboards > Manage Subnets and IP Addresses.

2. Drill down to the subnet containing the HSRP IP.

3. Select the IP address and click View Details.

4. In the IP Address Conflict Details widget, use the Hide Conflict option to suppress the conflict status for that IP.

This suppresses the conflict display in the IPAM UI for that specific IP address. Note: the underlying polling will continue to detect the MAC discrepancy; this option hides the reported status rather than changing the detection behavior.

Option 2: Filter by Individual IP Address in the Alert Definition

By adding an additional condition to the alert trigger, you can prevent the alert from firing for a specific HSRP IP address.

In the Alert Manager, add a trigger condition specifying:

IP Address is not equal to <HSRP IP address>

For environments with many HSRP IPs across multiple subnets, using a Custom SQL alert condition with AND NOT logic for each subnet is more reliable than layering multiple simple conditions. Example Custom SQL:

(IPAM_IPConflict.ActiveConflicts > 0)
AND NOT (IPAM_IPConflict.IPAddress LIKE '192.168.10.%')
AND NOT (IPAM_IPConflict.IPAddress LIKE '10.0.5.%')

Option 3: Filter by Group Using IP Address Comments (Bulk suppression)

For environments with a large number of HSRP IPs across many subnets, you can group them by adding a common value to the Comment field of each HSRP IP in IPAM, then use that comment value as a trigger condition in your alert definition.

1. Edit each HSRP IP address in IPAM and add a consistent comment such as HSRP.

2. In the Alert Manager, add a trigger condition:

   Comment contains HSRP

This allows you to manage exclusions at scale without modifying the alert definition each time a new HSRP IP is added — simply update the Comment field on the IP.