Technical Tip: Restriction on configuring broadcast IP addresses to FortiGate interfaces via CLI

Description

This article describes an issue where a FortiGate interface may accept a subnet broadcast IP address when configured via the CLI.

Scope

FortiGate.

Solution

When attempting to configure a broadcast IPv4 address on a FortiGate interface via the GUI, the following error is displayed:

However, the same configuration is accepted when performed via the CLI instead of returning the error.

FortiGate-60F # config system interface
FortiGate-60F (interface) # edit "b"
FortiGate-60F (b) # set ip 10.180.128.23/255.255.255.248
FortiGate-60F (b) # end

Starting from the versions mentioned below, the CLI returns an error when a broadcast IPv4 address is configured on an interface.

• v7.6.7 (scheduled to be released in June 2026).

• v8.0.0.
  

These timelines for firmware release are estimated and may be subject to change.

Note: /31 and /32 IPv4 subnets are not affected- it is still possible to configure the last address in GUI or CLI, both before and after the v8.0.0 change.

/31 subnets are used for links that require only 2 network addresses and no broadcast address, while /32 subnets are frequently used for loopback interfaces.

See the article Technical Tip: /31 subnet mask on FortiGate interface for point-to-point connection specially ISP connections.