%IP-4-DUPADDR: Duplicate address - comes from Catalyst 9300 with no ip

[kzajdlew]

Hi all,

have funny situation or maybe i do not understand something. In short, i have on multiple devices logs claims that i have duplicate ip address sourced by particular mac.  Of course i found it and it is mac address of c9300 interface.. but problem is that this switch has only mgmt ip, rest is just l2.. so none of ip addresses mentioned in logs do not exist there..  

logs : 

009184: Dec 27 06:59:01.890: %IP-4-DUPADDR: Duplicate address 172.21.17.13 on GigabitEthernet0/0/2.11, sourced by 0087.641c.17b5
009197: Dec 27 15:28:27.616: %IP-4-DUPADDR: Duplicate address 172.21.66.2 on GigabitEthernet0/0/2.15, sourced by 0087.641c.17b5

show interfaces tenGigabitEthernet 1/1/1
TenGigabitEthernet1/1/1 is up, line protocol is up (connected)
Hardware is Ten Gigabit Ethernet, address is 0087.641c.17b5 (bia 0087.641c.17b5)

so how it is possible that logs indicates on mac address which do not have any ip assigned ?  Actually whole switch does not have any of addresses mentioned in logs. Am i missing something ? 

my next steps which going to take : upgrade of soft anyway not sure it that could be somehow connected 

[MHM Cisco World]

are you config any DHCP in this SW?

[kzajdlew]

you mean dhcp server ? if so, then no, there is no dhcp server. Only i have dhcp snooping trust on interfaces 

[marce1000]

 - Have a sanity check of the running configuration as in : show run | inc 172

 M.

[kzajdlew]

show run | inc 172
ip name-server 172.21.19.102 10.0.40.192 10.0.40.193
ip address 172.21.39.22 255.255.255.192
ip route 0.0.0.0 0.0.0.0 172.21.39.1
permit 172.16.0.0 0.15.255.255

[marce1000]

            - Check the output of  : show mac-address-table | inc 0087.641c.17b5

 M.

[kzajdlew]

checked it at the begining, no result = lack of such entry 

[marce1000]

   - Try to trace the mac address by giving the particular command on other switches in the network too.

 M.

[kzajdlew]

but as you can see in first post, i found this mac which belongs to interface of switch 

[marce1000]

       - Try show arp | include 172.21.17.13  and show arp | include 172.21.66.2

 M.

[kzajdlew]

there is no such entry as switch has only mgmt ip and all arps comes from only this subnet / vlan 

[marce1000]

   - What happens if you try to ping one of those addresses ?

 M.

[kzajdlew]

they are normally responding as that ip belongs to routers which reports these duplicates, and switch is reaching it thx to default gw which is on mgmt vlan leading to router. 

[marce1000]

    - What is the software version on the 9300 ?

 M.

[kzajdlew]

16.9.2