windows server (VM) complaing an address conflict for IP address 0.0.0.0 with the system from the Gi0/1 interface from Cisco 2960C

[zhilimailbox]

have a widows server (VM) complaining

"The system detected an address conflict for Ip address 0.0.0.0 with system having network hardware address 1C:DE:A7:BD:2B:8D. Netwrok operations on this system may be disrupted as a result". screenshot attached. 

The MAC address 1C:DE:A7:BD:2B:8D is Gi0/1 of Cisco 2960C. After googling, the issue seems caused by IPDT 

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/8021x/116529-problemsolution-product-00.html. 

However, we I check on the switch 

QBR-LXE-2960-06#show ip device tracking all
Global IP Device Tracking for clients = Disabled
-----------------------------------------------------------------------------------------------
IP Address MAC Address Vlan Interface Probe-Timeout State Source
-----------------------------------------------------------------------------------------------

#show ip device tracking int gi0/1
--------------------------------------------
Interface GigabitEthernet0/1 is: STAND ALONE
IP Device Tracking = Disabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
IP Device Tracking Enabled Features:
--------------------------------------------

interface GigabitEthernet0/1
description UPlink 
switchport trunk allowed vlan 1,44,100
switchport mode trunk
switchport nonegotiate
spanning-tree bpdufilter disable
spanning-tree bpduguard disable
end

I have done a 5 minutes packet capture on the uplink port Gi0/1 and I can't see any ARP request/probes. 

Could any one shed some light on why the windows server got this duplicate IP error, if IPDT is disabled?

Thanks

[marce1000]

 - There are some extra suggestion in this thread to disable IPDT, at the interface level too , check if that can help for your case :

                          https://community.cisco.com/t5/switching/ip-device-tracking/td-p/2342329

 M.

[zhilimailbox]

Thanks for your reply. The confusion is the show command result indicates that the IPDT is disabled. I did enable IPDT on the Gi0/1 interface and I did see ARP probes every 30s as should be. 

Seems the duplicatioin only happens after the windows server reboot and not always

Kind regards,

[Georg Pauwen]

Hello,

the problem could be the Windows server itself. Try the procedure below:

1. Click Start , type regedit in the Start Search box, and then press ENTER.

2. Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

3. On the Edit menu, point to New , and then click DWORD Value .

4. Type ArpRetryCount .

5. Right-click the ArpRetryCount registry entry, and then click Modify .

6. In the Value data box, type 0 , and then click OK .

7. Exit Registry Editor.

[zhilimailbox]

Thanks, I will talk to the server engineer for the suggestion.

Just it is weird that the cisco 2960's MAC is there in the windows event log.

The same IP duplication/conflict issue happened a few times already although it doesn't happen often. 

[marce1000]

 - The suggestion from Georg is also advised here :

               https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtn27420

 M.

[pieterh]

I suggest is is just a windows/VM thing and has nothing to do with IPDT.

in this environment there is some unconfigured adapter that tries DHCP broadcasts using addresss 0.0.0.0

and the system receives DHCP broadcasts from other clients on the network using 0.0.0.0 as source address

possibly there is no DHCP server on this subnet so the requests never get a DHCP reply

[zhilimailbox]

In fact, the windows server, which has the IP duplicate/conflict issue, is the DHCP server on that particular NIC/VLAN. The NIC is static assigned. 

The duplication/conflict happens when the server reboots and very likely the DHCP Service is not started yet.

It worths to try Georg's workaround.

Thanks,

[zhilimailbox]

Hi, 

Checked with the server engineer that the gratuitous ARP is diabled already. On the cisco 2960, we have IPDT disabled and IPDT delay 10 is configured

The switch, having IPDT disabled, sends ARP probes, while Windows server checks IP conflict when gratuitous ARP disabled. 

Could  any one see what is the problem and any other work around to try?

Kind regards,

[acampbell]

Hi,

Have a read at this from TAC.

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/8021x/116529-problemsolution-product-00.html

[zhilimailbox]

On the cisco 2960, we have IPDT disabled and IPDT delay 10 is configured. Seems, the switch still sends ARP probes when the link from down to up. Any other suggestions?

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 14 WS-C2960C-12PC-L 15.2(2)E C2960c405-UNIVERSALK9-M

Thanks,

[skovalak]

Solution is this command in powershell on affected windows server machine:

Set-NetIPInterface -InterfaceAlias "Ethernet" -AddressFamily IPv4 -DadTransmits 0

https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/event-4199-windows-client-cannot-get-ip-address-dhcp-server#deactivate-the-ip-device-tracking-feature-or-delay-sending-arp-probe-requests

Where "Ethernet" your name of Network Device from Control Panel.