DMZ

[wess]

Hi all i tried to add a dmz but i have an error FGT80Cxxxxxxxxxx # config system interface FGT80Cxxxxxxxxxx (interface) # edit dmz FGT80Cxxxxxxxxxx (dmz) # set ip 192.168.33.0 255.255.255.0 ip address is illegal value parse error before ' 255.255.255.0' Command fail. Return code -8 But when i use a MASK /22 i don' t have an error anyone can explain me why i cannot use an /24 as mask ? thank you in advance for your answer

[Matthijs]

You might want to check your ip calculator on this one ;-) 192.168.33.0/24 (or 255.255.255.0) is a subnet of 256 hosts. You can use 254 ip addresses. 192.168.33.0 is the network address (not usable) 192.168.33.1 - 254 are the usable addresses 192.168.33.255 is the broadcast address (not usable) But when using 192.168.33.0/22 this is actually 192.168.32.0/22 Addresses as follows: 192.168.32.0 Network address 192.168.32.1 - 192.168.35.254 usable addresses, so 192.168.33.0 is just one of them like 192.168.33.255 in this case is also usable 192.168.35.255 - Broadcast address so not usable. check somethink like Wikipedia about this :)

[rwpatterson]

2 questions 1) What firmware version 2) Did you try from the GUI as well It may be a bug.

[wess]

1) Firmware Version v4.0,build0209,100929 (MR1 Patch 8) 2) when i use the GUI i get this error message : Invalid IP Address.

[rwpatterson]

LOL! I went right to the bottom. IGNORE my prior post, duh! (We must have hit at the same time....)

[ede_pfau]

Good grief, Matthijs already posted your mistake: You specify " 192.168.33.0" as the interface address - this is not permitted (not with Fortinet nor with any other equipment). Put in " 192.168.33.1" and it' ll work, regardless of the network mask. And no, " .33.1/22" is NOT " .32.1" ' in real' . Both Class C network are comprised but the interface address is unique.

[wess]

thank you all a lot for your explanations i changed my dmz ip address 33.1/24 and it works perfectly

[ede_pfau]

just as a follow-up:

But when i use a MASK /22 i don' t have an error

...because then you have a range of 1024 addresses of which only the first .32.0 and the last .35.255 are unavailable. A .33.0 is perfectly OK then. But in practice you would avoid it as confusing.