Duplicate IP Alarm

[dpanev]

HI Guys,

is there a way to get an alarm for duplicate activ ip's?

We have a customer with this request

[Ryan_Yacobucci · Accepted solution]

Hello,

There is a feature buried within the Control WebView that can show duplicate IPs. I think it does end up setting a message over into the XIQ-SE server within one of the Control logs. 

Can you go to Alarms & Events --> Events --> Set the type to NAC, AccessControlEngine, Access Control Audit.
Try and search for "duplicate". If the log shows up you can build an alarm within the alarms configuration to look for that specific string in the NAC logs and set an alarm. 

Potentially there is a workflow that could be built to run an SQL query, or even a report made. 

select macAddress, ipAddress, COUNT(ipAddress) from tam_endsystem where state = 'ACCEPT' group by ipAddress having COUNT(ipaddress) >1;

Thanks
-Ryan