New Member

Solved

Forti Manager - BGP Prefix Lists ge / le buggy?

Forum|Forum|8 months ago
December 1, 2025
7 replies
1003 views

Hi there,
we are working with multiple IPv4 subnets in the area 10.98.0.0/19 but we're configuring them on multiple interfaces as multiple networks with subnet lenght 26.

I'd like to add a filter to the prefix list - In Bird2 you can work with greater than equal or less than equal like 10.98.0.0/16{26,26}

I tried the same on forti manager, I've added a an entry to the prefix list and entered 26 as prefix length in both greater than and less than. But it throws an error:

Screenshot 2025-12-01 111100.png

I don't understand quite right, as it keeps telling me "Greather than" must be greater than prefix (met) and less than or equal than "less than" (which is met as it's equal to it)...

What am I missing?

Best answer by dditahi

Works like a charm when set via CLI.

edit 1
set prefix 10.98.0.0 255.255.240.0
set ge 26
set le 26
next

funkylicious

SuperUser

hi,

please have a read at https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-combine-operators-ge-and-le-in-prefix-list/ta-p/205500

in your prefix-list, have specified already the /26 mask, therefore ge 26 and le 26 doesnt make any sense.

if you desire only the /26 mask then leave le/ge blank since specify ( equal ) is already selected, otherwise use a longer ( /19 ) subnet/prefix and follow the example in the KB.

"jack of all trades, master of none"

dditahiAuthor

New Member

Thanks - but i have multiple Prefixes /26 in the range 10.98.0.0/20

means: 10.98.0.0/26, 10.98.0.64/26, 10.98.0.128/26, 10.98.0.192/26, ... (there are in summary arround 40 small networks)

How can I allow to accept any route that meets this criteria, means if it's in 10.98.0.0/20 and it's a /26 accept it.

Hence - If i set only ge 26 i allow also networks announces as /25, /24, /23, /22, /21, /20 - and if set only le than i allow also /32, /31, /30, /29, /28, /27.

And if I leave these empty to just say 10.98.0.0/26 it's only this one subnet.

funkylicious

SuperUser

10.98.0.0/20 le 27 ge 26 should get you what you want.

L.E. or try 10.98.0.0/20 le 26 ge 26

"jack of all trades, master of none"

Toshi_Esumi

SuperUser

I think you're thinking 'ge' and 'le' in opposite direction. ge 26 = /26+/27+/28+/29+/30+/31+/32.
The CLI guide says below:

ge	Minimum prefix length to be matched.	integer	Minimum value: 0 Maximum value: 32
le	Maximum prefix length to be matched.	integer	Minimum value: 0 Maximum value: 32

And those GUI's descriptions are not accurate. They're "greater or equal" and "less or equal" just like Cisco's.
If you want to block those other than /26s, you might need to have two clauses.

edit 1

set action deny

set prefix 10.98.0.0/20
set ge 27

unset le

set action permit

set prefix 10.98.0.0/20
set ge 26
unset le
next

You can easily translate this to GUI.

Toshi

dditahiAuthorAnswer

New Member

Works like a charm when set via CLI.

edit 1
set prefix 10.98.0.0 255.255.240.0
set ge 26
set le 26
next

Toshi_Esumi

SuperUser

Ok, that was one of GUI limitations then. I never used GUI for routing protocol related config. Lots of red tapes here and there.

Toshi

funkylicious

SuperUser

nvm, im tired and delusional :)

"jack of all trades, master of none"

Sign up

Login with SSO

Login to the community

Login with SSO