Adding Secondary IP address

No you are not doing anything wrong your fortigate is. There is a bug in the GUI which stops you being able to add secondary IP addresses. Its acrtually slightly worse in that if you have added one via CLI and then make any changes via teh GUI it deleted it. To workaround you need to add the secondary IP via CLI. This is also quite convoluted. use the following conf sys int edit [inteface name] conf secondaryip set ip x.x.xx x.x.x.x ...... setup any other parameters you want, use set ? to see the options end end

Keep in mind that the secondary IP is not overlapping your primary. Regards, Eric

I am trying to add a secondary IP address that is in the same subnet as the main IP. Is that not allowed on these units? When I run these commands it tells me that the IP is in the same subnet as the interface IP and then says " discard the setting" . I am trying to set this unit up to mirror the config on our existing firewall where it has an alias IP that is one up from the main IP (don' t really know why this was done... but it would be a LOT of work to move all traffic to the main address right now). Could I assign this IP to my other WAN port? Or will that fail also? I have a 200A running 3.0

So I managed to figure this one out (helps to read the manual...) In the CLI (yes I am starting to use the CLI too) I entered: config system global set allow-interface-subnet-overlap enable end Then configured the secondary IP and it worked! (I feel so accomplished)! Any pros or cons to doing this? I am guessing that the overlap setting is likely disabled by default for a reason... but I need it to make this implementation easier.