Nothing is quite as awesome as believing you’re an expert at something and then having something simple completely throw you for a loop. Today, I was working on creating some point to point VPN connections on a Sonicwall TZ 205 firewall and needed to create some address objects for the various remote networks. I filled in all of the information for creating a Network object and went to save it and go the following error message kicked back at me:
[callout] Error: Creating Network: Invalid netmask[/callout]
I stare at it for a bit wondering if I have a space on the end of one of the fields and retype everything. Same problem. I stare at it some more, thinking WTF is wrong here? I check in with my good friend Google and am not really finding any clues. And then, there it is.
In strict instances, such as this, the network MUST be entered as the root IP address of the network. While it’s little known that this IP address can be used in some circumstances (I saw it recently done on a client’s network using Juniper gear), it’s generally the IP that nobody uses because it’s reserved for the network.
In this case, it’s 192.168.2.0 for a /24 (255.255.255.0) network. Any number other than a 0 for this particular netmask will throw things for a loop and give you this error message.
For those of us who are experienced network administrators, we want to smack our heads for falling for something so simple. Given that I couldn’t find a quick and easy answer online, I thought I’d post this hear for other smart people making a simple mistake as well. As usual, if you found this helpful or have a question for your particular scenario, feel free to leave me a comment. Enjoy!
THANK YOU!!!! Just did the same thing setting up a site to site VPN from an RV042 to a Sonicwall. So silly of me…
Sweet! Glad that this helped someone else.
I second the comment – so silly of me as well, TY!
Yes, feeling pretty stupid about this. Is the zero required because you are hitting a network, not assigning an IP to that network (not controlled by this device)?
Yes, it has to be a digit that lines up with a the first IP in a network block depending on the subnet mask you’re using. So it can be something other than a zero if you’re using a smaller netmask, but it sill has to be the first IP in that block as far as I can tell, since that represents the start of the network scope you’re using.
For example, if your subnet mask was /29 (255.255.255.128) your network could be 192.168.0.0 OR 192.168.0.128. Does that make sense?