IP address is in same subnet as the others

[dMb]

Hi I have a Fortigate 100D Running Firmware: FG100D-5.00-build228 Trying to get a VPN from it to AWS (Amazon) but get " IP address is in same subnet as the others" error when setting up the VPN interface. The instructions I get from AWS are as follows and they use 169.254.255.xxx IPs for the local and remote IP on the interface. Go to System Tab --> Network --> Interface --> wan1 and edit Amazon-IKE-vpn-xyz-0 a. Name: Tunnel. Tunnel1 b. IP : 169.254.255.74 c. Remote IP: 169.254.255.73 d. Select Ping e. Administrative Status: Up f. Select Ok. Then I just get an error " IP address is in same subnet as the others" (see screen shot attached) The Fortigate 100D for some reason will not let me use these 169.254.255.xxx IPs. If I try adding say 10.255.0.2 and 10.255.0.1 it will apply with no error but Amazon need me to use 169.254.255.74 and 169.254.255.73 to get VPN up. Spent hours on phone with AWS (Amazon) and they have never seen this before. We set these VPNs up all the time but 99% of customers use Cisco ASAs. Anyone any idea? No where else on the appliance are these IP used. Thanks!

[emnoc]

Look thru out your cfg, you have the 169.254.xxx.xxx assign to some other interface(s) as secondary or primary or check your netmask for that tunnel

[ede_pfau]

To facilitate the search, you can download the config (unencrypted) and search through with grep or in an editor. If you assign an APIPA address to an unused physical port, do you see the same error? I find it funny to see that AWS uses APIPA addresses, or even requires them. Probably for monitoring (?) from their side. For an IPsec tunnel you don' t need IPs at the tunnel ends.

[dMb]

thank you for the replies. Searched the conf and " 169" does not appear anywhere in it. The netmask for the tunnel is 255.255.255.255 See attached for how I am trying to add these IPs. Should I be using an netmask them? Do you think the VPN might work if I just leave these as 0.0.0.0?

[ede_pfau]

I just tested this with FOS 4.3.17, no problem. I entered the IP without any netmask, just as " 169.254.255.73" . It will be used as a /32 (single host) by default. And yes, I' d think the tunnel will work even ' unnumbered' . Just give it a try. But then again, I' ve never tried to configure a tunnel to AWS.

[emnoc]

AWS uses APIPA address on all VPCs to ensure uniqueness. btw APIPA works for me; config system interface edit " main" set vdom " root" set ip 169.254.122.1 255.255.255.255 set type tunnel set remote-ip 1.1.1.1 set snmp-index 24 set interface " wan1" next end 5.2GA

[Sean_Toomey_FTNT]

Hi dMb, First things first.. build 228 is older 5.0 firmware. Please upgrade to the latest patch which is 5.0.8. After doing so, please recheck to see if you are still having a problem. Generally as others have already mentioned, you only receive this error if you have that IP range tied to another interface somehow. If you still have an issue after upgrading, the best advice I can give you is to open a TAC case so they can see your full config. Provide a config backup and a diag debug report / exe tac report. I am confident they can get you working. Hope this helps! Cheers!