Web cache policy address formats

A source or destination address can contain one or more network addresses. Network addresses can be represented by an IP address with a netmask or an IP address range.

When representing hosts by an IP address with a netmask, the IP address can represent one or more hosts. For example, a source or destination address can be any of the following:

• a single computer, for example, 192.45.46.45
• a subnetwork, for example, 192.168.1.* for a class C subnet
• 0.0.0.0 matches any IP address

The netmask corresponds to the subnet class of the address being added and can be represented in either dotted decimal or CIDR format. The FortiProxy unit automatically converts CIDR-formatted netmasks to dotted decimal format. Example formats:

• netmask for a single computer: 255.255.255.255 or /32
• netmask for a class A subnet: 255.0.0.0 or /8
• netmask for a class B subnet: 255.255.0.0 or /16
• netmask for a class C subnet: 255.255.255.0 or /24
• netmask including all IP addresses: 0.0.0.0

Valid IP address and netmask formats include:

• x.x.x.x/x.x.x.x, such as 192.168.1.0/255.255.255.0
• x.x.x.x/x, such as 192.168.1.0/24

An IP address 0.0.0.0 with the netmask 255.255.255.255 is not a valid source or destination address.

When representing hosts by an IP address range, the range indicates hosts with continuous IP addresses in a subnet, such as 192.168.1.[2-10], or 192.168.1.*, to indicate the complete range of hosts on that subnet. You can also indicate the complete range of hosts on a subnet by entering 192.168.1.[0-255] or 192.168.1.0-192.168.1.255. Valid IP range formats include:

• x.x.x.x-x.x.x.x, for example, 192.168.110.100-192.168.110.120
• x.x.x.[x-x], for example, 192.168.110.[100-120]
• x.x.x.*, for a complete subnet, for example: 192.168.110.*
• x.x.x.[0-255] for a complete subnet, such as 192.168.110.[0-255]
• x.x.x.0 -x.x.x.255 for a complete subnet, such as 192.168.110.0 - 192.168.110.255

You cannot use square brackets [ ] or asterisks * when adding addresses to the CLI. Instead you must enter the start and end addresses of the subnet range separated by a dash -. For example, 192.168.20.0-192.168.20.255 for a complete subnet and 192.168.10.10-192.168.10.100 for a range of addresses.