Okta Network Zone Save Fails Due to Duplicate IP Addresses
Last Updated:
Overview
Okta prevents saving a Network Zone when duplicate or overlapping IP addresses are present in the configuration. This occurs because a strict validation engine ensures no overlapping IP definitions exist in security perimeters. To resolve this, administrators must remove the duplicate IPs or create a new Network Zone blocklist for new IPs. When attempting to save a Network Zone with overlapping IPs, Okta displays a prompt listing the duplicate IPs and blocks the save. Existing Network Zone blocklists remain valid and active despite the presence of duplicates, but Okta restricts adding new IPs until the duplicates are cleared.
Duplicate IPs: <1.2.3.4>-<1.2.3.4> found. Make sure you provide only unique IPs.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Network Zones
- Security
Cause
Okta implemented a strict validation engine to ensure no overlapping IP definitions exist within security perimeters. If Okta detects any duplicate or overlapping IP addresses within the zone configuration, it blocks the save action.
Solution
How are duplicate IP addresses in a Network Zone resolved?
Administrators must locate and remove the duplicate IP addresses listed in the error prompt from the existing Network Zone to save new additions. Alternatively, administrators can bypass this restriction by creating a new Network Zone blocklist for the new IP addresses.
Create a new Network Zone blocklist to immediately block new threats and analyze the original zone for duplicates at a later time.
- Navigate to Security, and then select Networks.
- Choose Add Zone and select IP Zone.
- Enter a name for the new zone.
- Select the Block access from IPs matching conditions listed in this zone checkbox.
- Enter the new IP addresses in the Gateway IPs or Proxy IPs fields.
- Select Save.
NOTE: The presence of duplicate IP addresses does not invalidate the existing Network Zone blocklist. Okta continues to enforce the existing blocklist, but restricts adding new IP addresses until the duplicates are removed.
