Secondary IP addresses to an interface

Secondary IP addresses to an interface

If an interface is configured with a manual or static IP address, you can also add secondary static IP addresses to the interface. Adding secondary IP addresses effectively adds multiple IP addresses to the interface. Secondary IP addresses cannot be assigned using DCHP or PPPoE.

All of the IP addresses added to an interface are associated with the single MAC address of the physical interface and all secondary IP addresses are in the same VDOM as the interface that are added to. You configure interface status detection for gateway load balancing separately for each secondary IP addresses. As with all other interface IP addresses, secondary IP addresses cannot be on the same subnet as any other primary or secondary IP address assigned to a FortiGate interface unless they are in separate VDOMs.

To configure a secondary IP, go to System > Network > Interface, select Edit or Create New and select the Secondary IP Address check box.

6 thoughts on “Secondary IP addresses to an interface

  1. FortiGate100D

    I have a customer with one wan interface with a /30.
    the isp is delivering a /28 to the customer via this /30 as a routable ip allocation.
    I know with cisco this isn’t a problem, with fortigate it seems to be a problem, if if add a vip that is part of the /28 it doesn’t work.
    Fortigate support have given me two different answers,
    1. it should work
    2. it wont work as the vip has to be associated with a subnet that is assigned to a physical interface.
    I thought about secondary ip but don’t really want to do that as isp router may not like it.
    can anyone shed any light??

    1. Mike Post author

      ISP’s here do that all the time. Should definitely work. Every instance I have deployed situations like this I have just setup a VIP using the IP’s from the /28 etc that is being routed to the /30.

      My guess would be to verify that ISP properly routed the /28 to the /30 or to IP the Gate has on the WAN interface. If that is proper things should flow just fine as long as proper policy exists. You don’t want to do a secondary IP in this situation. It’s a waste of a good IP for ya!

  2. Soldat

    Usually when you configure an VIP on an interface you’d get two options.

    1. The router sending in will be forwarding traffic to the Fortigate anyway which will then respond saying it owns the VIP you have configured.

    2. An ARP might get sent for the VIP you configured at which point the fortigate would respond.

    Fortinet are right, that should be working. Firmware up to date and the Fortigates not in conserve mode or anything?

  3. Ella Carmon


    Appreciate your help.
    I’ve created a new vlan for a new wifi ssid, I’ve added a secondary ip in the wan interface and created ip pool. In the ipv policy I’ve routed the new WiFi through the wan with the ip pool. But i still don’t have any internet access on the new WiFi. What did I do wrong ?
    Thanks !!!

  4. ella


    I am trying to connect a secondary ip to a new vlan, i’ve created an ip pool and attached to the policy of the new vlan. secondary ip shows reply from world which mean it works, but my vlan doesnt have internet access
    what did i misconfigured?


  5. mabbd

    Hello: If I may ask a question, please:
    Using a FortiGate 100 Firewall, My Network is 192,168.1.0 which has available 254 IP addresses for my smart devices and people. I ran out of IP addresses, How do I increase IP addresses in my Network. Should I use Secondary IP addresses? If yes, how to configure it. If now, then how should I increase my IP addresses?


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.