Global Security Forum

 View Only

 Qradar duplicate subnets issue

Michail Christof's profile image
Michail Christof posted 05/13/26 07:11 AM

Hello everyone,

I would like to ask for recommendations/best practices regarding overlapping internal networks in QRadar.

Ι have aν environment where the same internal subnet is used in different remote sites/networks. For example, the subnet 192.168.10.0/24 exists in more than one location (one of them is a Guest network).

The issue is that QRadar detects the subnet as duplicate in the Network Hierarchy, so we cannot create separate entries for each network/site.

Has anyone handled a similar scenario in QRadar?

Any recommendations or design approaches would be greatly appreciated.

Thanks for your time. 

Collins Curtis's profile image
Collins Curtis posted 05/14/26 03:30 AM

Hi,

I’m not entirely an expert, but looking at the overlapping issue, I think you should check out Domain Management to solve this.

Since QRadar uses the IP range as a unique identifier in the Network Hierarchy, it blocks duplicate entries. To get around this, you can:

  • Create separate Domains for each of your remote sites.

  • Map your Log Sources (or even the Event Collectors) to those specific domains.

Once you’ve assigned the data sources to a domain, QRadar creates a 'context' for that traffic. This allows you to define the same 192.168.10.0/24 subnet multiple times in the Network Hierarchy one for each domain so QRadar can finally separate the flows correctly.

Hope this helps!"

Collins Curtis's profile image
Collins Curtis posted 05/14/26 03:33 AM

Hi,

I’m not entirely an expert, but looking at the overlapping issue, I think you should check out Domain Management to solve this.

Since QRadar uses the IP range as a unique identifier in the Network Hierarchy, it blocks duplicate entries. To get around this, you can:

  • Create separate Domains for each of your remote sites.

  • Map your Log Sources (or even the Event Collectors) to those specific domains.

Once you’ve assigned the data sources to a domain, QRadar creates a 'context' for that traffic. This allows you to define the same 192.168.10.0/24 subnet multiple times in the Network Hierarchy one for each domain, so QRadar can finally separate the flows correctly.

Hope this helps!"

Dusan VIDOVIC's profile image
Dusan VIDOVIC posted 05/14/26 04:10 AM

On QRadar there is a concept of Domains that allows distinguishing overlapping segments; have a look at Domain segmentation. If I recall correctly ('been a while since I dealt with this) you would create separate hierarchy per domain. 

Bubai Maity's profile image
Bubai Maity posted 05/14/26 09:22 PM

At present, IBM QRadar does not support this.

However, using Domain Management (Admin → System Configuration → Domains), you can create separate domains, and each domain will have its own Network Hierarchy. 
You can then assign log sources to the appropriate domains.

However, this will result in separate management of users, rules, and reports for each domain.

Dusan VIDOVIC's profile image
Dusan VIDOVIC posted 05/15/26 10:55 AM

Re: domain unaware, domain aware and system wide rules... in 2018 there was an OpenMic webinar dedicated to the topic of Domains and tenants, and there you could find also the following part regarding the "domain unaware" rules (which might be of interest/importance):

If a rule is not domain aware (does not contain a domain rule test) 
- Rule counters are maintained separately for each domain
- The rule is triggered separately for each domain
 -Offenses are created separately for each domain that is involved
- The offenses are tagged with those domains. 

I don't think things changed much since. 

Michail Christof's profile image
Michail Christof posted 05/21/26 05:59 AM

Thank you all for your answers. 
I will try this approach. 

Related Content