Adding Secondary IP address

[#1]

Hi am fairly new to the fortigate arena. We have a fortigate 100A updated the firmware to ver 3.00 MR4. I am trying to add a secondary ip address to my wan2 interface. However after I apply it, is does not seem to hold, but it does not give any errors when doing so either. Any ideas to why, would be great. Or how I go about it if I' m doing wrong Thanks

[doshbass]

No you are not doing anything wrong your fortigate is. There is a bug in the GUI which stops you being able to add secondary IP addresses. Its acrtually slightly worse in that if you have added one via CLI and then make any changes via teh GUI it deleted it. To workaround you need to add the secondary IP via CLI. This is also quite convoluted. use the following conf sys int edit [inteface name] conf secondaryip set ip x.x.xx x.x.x.x ...... setup any other parameters you want, use set ? to see the options end end

[FortiRack_Eric]

Keep in mind that the secondary IP is not overlapping your primary. Regards, Eric

[#4]

I am trying to add a secondary IP address that is in the same subnet as the main IP. Is that not allowed on these units? When I run these commands it tells me that the IP is in the same subnet as the interface IP and then says " discard the setting" . I am trying to set this unit up to mirror the config on our existing firewall where it has an alias IP that is one up from the main IP (don' t really know why this was done... but it would be a LOT of work to move all traffic to the main address right now). Could I assign this IP to my other WAN port? Or will that fail also? I have a 200A running 3.0

[#5]

So I managed to figure this one out (helps to read the manual...) In the CLI (yes I am starting to use the CLI too) I entered: config system global set allow-interface-subnet-overlap enable end Then configured the secondary IP and it worked! (I feel so accomplished)! Any pros or cons to doing this? I am guessing that the overlap setting is likely disabled by default for a reason... but I need it to make this implementation easier.

[rwpatterson]

You could have just used a virtual IP to accept traffic on the second IP, and a single IP pool to have outgoing traffic appear to be from that same IP address. All that could have been done from the GUI. My two cents. Have no ideas about the pros and cons. I' m a GUI kind of guy.