diff --git a/pkg/controller/ip.go b/pkg/controller/ip.go
index b29055742e3f..a7e34da0d1bb 100644
--- a/pkg/controller/ip.go
+++ b/pkg/controller/ip.go
@@ -496,16 +496,17 @@ func (c *Controller) createOrUpdateCrdIPs(ipCRName, podName, ip, mac, subnetName
 			return nil
 		}
 
-		_, err := c.config.KubeOvnClient.KubeovnV1().IPs().Update(context.Background(), newIPCR, metav1.UpdateOptions{})
+		ipCR, err = c.config.KubeOvnClient.KubeovnV1().IPs().Update(context.Background(), newIPCR, metav1.UpdateOptions{})
 		if err != nil {
 			err := fmt.Errorf("failed to update ip CR %s: %v", newIPCR.Name, err)
 			klog.Error(err)
 			return err
 		}
-		if err := c.handleAddIPFinalizer(ipCR, util.ControllerName); err != nil {
-			klog.Errorf("failed to handle add ip finalizer %v", err)
-			return err
-		}
+	}
+
+	if err := c.handleAddIPFinalizer(ipCR, util.ControllerName); err != nil {
+		klog.Errorf("failed to handle add ip finalizer %v", err)
+		return err
 	}
 
 	return nil
diff --git a/pkg/webhook/ip.go b/pkg/webhook/ip.go
index 31751e7c8e18..f8a1074df330 100644
--- a/pkg/webhook/ip.go
+++ b/pkg/webhook/ip.go
@@ -6,12 +6,13 @@ import (
 	"net"
 	"net/http"
 
-	ovnv1 "github.com/kubeovn/kube-ovn/pkg/apis/kubeovn/v1"
-	"github.com/kubeovn/kube-ovn/pkg/util"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	ctrlwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	ovnv1 "github.com/kubeovn/kube-ovn/pkg/apis/kubeovn/v1"
+	"github.com/kubeovn/kube-ovn/pkg/util"
 )
 
 var ipGVK = metav1.GroupVersionKind{Group: ovnv1.SchemeGroupVersion.Group, Version: ovnv1.SchemeGroupVersion.Version, Kind: "IP"}
@@ -39,6 +40,10 @@ func (v *ValidatingHook) IPUpdateHook(ctx context.Context, req admission.Request
 		return ctrlwebhook.Errored(http.StatusBadRequest, err)
 	}
 
+	if err := v.ValidateIP(ctx, &ipNew); err != nil {
+		return ctrlwebhook.Errored(http.StatusBadRequest, err)
+	}
+
 	// ip can not change these specs below
 	if ipNew.Spec.Namespace != ipOld.Spec.Namespace {
 		err := fmt.Errorf("ip %s namespace can not change", ipNew.Name)