Skip to main content
carlos_cosmo
carlos_cosmo
New Member
April 9, 2020
Question

Wildcard Cisco to Fortinet

  • April 9, 2020
  • 1 reply
  • 3932 views

Hello,

I'm new here on the forum and I need some help...

I would like to know if my Wildcard bellow converting to Fortinet is correct?

 

10.128.80.224/0.63.13.31 -> 00000000.00111111.00001101.00011111 - Wildcard Cisco 10.128.80.224/255.192.242.224 ->11111111.11000000.11110010.11100000 - Wildcard Fortigate

 

 

    1 reply

    lobstercreed
    lobstercreed
    New Member
    April 12, 2020

    While I have never used a wildcard object (Cisco or FortiGate), after doing a quick search it seems you've got it.

     

    https://forum.fortinet.com/tm.aspx?m=92514

     

    https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-firewall/Object%20Configuration/Addresses/Wildcard%20addressing.htm

    carlos_cosmo
    carlos_cosmoAuthor
    New Member
    April 19, 2020

    To you better understand our challenge, We are moving an ACL from our old Cisco switch to a new Fortinet firewall. This is an example of some lines we´re triyng to move:

     

    ACLs Old Cisco:

    10.128.80.224 0.63.13.31 10.206.5.0 0.0.0.31  10.128.80.224 0.63.13.31 10.206.11.0 0.0.0.15  10.192.80.224 0.7.13.31 10.206.11.0 0.0.0.15 Even after we check for Official Guide (the link you provide) how to configure wildcard mask, I still have doubt, cause I'm not found an example that matches the wildcard we are using. Basically lobstercreed, I want help to understand the Fortinet´s wild mask standard. I want to know if this ACL address using IP/wildmask 10.128.80.224/0.63.13.31, will reflect the same configuration on Fortinet´s policy if I´ll configure 10.128.80.224/255.192.242.224.

    lobstercreed
    lobstercreed
    New Member
    April 19, 2020

    You're going to have to prove it to yourself then.  The guide says it will work, but you still doubt it. 

     

    I don't have a network designed the way you're describing and I'm not interested in spending the time setting up a test for something I will probably never use.

     

    You already have a network where you can test this, so I'd recommend doing as you've described which follows the guide exactly. I see no reason why it wouldn't work.

    Terms & ConditionsAccessibility statement