Fortinet white logo
Fortinet white logo

Administration Guide

Policy

Policy

The policy list displays firewall policies in their order of matching precedence. Firewall policy order affects policy matching. For details about arranging policies in the policy list, see Change how the policy list is displayed.

You can add firewall policies that match HTTP traffic to be cached according to source and destination addresses and the destination port of the traffic.

Various right-click menus are available throughout the policy list. The columns displayed in the policy list can be customized, and filters can be added in a variety of ways to filter the information that is displayed. See Change how the policy list is displayed.

To view the policy list, go to Policy & Objects > Policy.

Hover over the leftmost edge of the column heading to display the Configure Table icon, which you can use to select the columns to display or to reset all the columns to their default settings. You can also drag column headings to change their order.

The following options are available:

Create New

Add a new policy. New policies are added to the bottom of the list. See Create or edit a policy.

Edit

Edit the selected policy. See Create or edit a policy.

Delete

Delete the selected policy.

Policy Lookup

Find a policy.

Search

Enter a search term to find in the policy list.

Export

Export the current view to CSV and JSON formats. Click Export and select CSV or JSON to download the file.

Interface Pair View/By Sequence

Select how to view the policy list:

  • Interface Pair View—Displays the policies in the order that they are checked for matching traffic, grouped by the pairs of Incoming and Outgoing interfaces. For instance, all of the policies referencing traffic from WAN1 to DMZ will be in one section. The policies referencing traffic from DMZ to WAN1 will be in another section. The sections are collapsible so that you only need to look at the sections with policies you are interested in.

  • By Sequence—Displays the policies in the order that they are checked for matching traffic without any grouping. The FortiProxy unit automatically changes the view on the policy list page to By Sequence whenever there is a policy containing the any interface. If the Interface Pair View is grayed out, one or more of the policies is using the any interface.

Type

The type of policy, such as Explicit Web, Transparent, or SSH Tunnel. See Policy types.

Name

The name of the policy.

Incoming Interface

The incoming interface or interfaces.

Outgoing Interface

The outgoing interface or interfaces.

Source

The source is the source address or source user of the initiating traffic.

Destination

The destination address or address range that the policy matches. For more information, see Web cache policy address formats.

Forwarding Server

The upstream forwarding server that the policy will forward traffic to.

Schedule

The time frame that is applied to the policy. See Schedules.

Service

The service or services chosen here represent the TCP/IP suite port numbers that will most commonly be used to transport the named protocols or group of protocols. See Services.

Action

The action to be taken by the policy, such as ACCEPT, DENY, REDIRECT, or ISOLATE.

Security Profiles

All the profiles used by the policy, such as AntiVirus, Web Filter, DLP Profile, ICAP, SSL Inspection, and Content Analysis options. See Security Profiles.

Log

The logging level of the policy. Options vary depending on the policy type.

Bytes

The number of bytes.

Applications、

Application names, application categories, and application groups that use the policy.

See Policy matching using applications for more details.

URL Category

URL categories that use the policy.

Active Sessions

The number of active sessions.

Application Control

What action is taken when an application matches.

AV

The antivirus profile used by the policy. See Antivirus.

Comments

Comments about the policy (up to 1023 characters).

Destination Address

The destination addresses that the policy matches. The destination address can be used as a traffic filter.

DNS Filter

The DNS filter profile used by the policy. See DNS Filter.

Email Filter

The email filter profile used by the policy. See .

Enforce ZTNA

Whether Zero Trust Network Access (ZTNA) is enabled or disabled. See Zero Trust Network Access introduction.

File Filter

The file filter profile used by the policy. See File Filter.

First Used

When the policy was first used.

Groups

Which groups the policy matches.

Hit Count

Number of results found.

ICAP

The ICAP profile used by the policy. See Create or edit an ICAP profile.

ID

The policy identifier. Policies are numbered in the order they are added to the configuration.

IPS

Which IPS signatures the policy uses.

Last Used

When the policy was last used.

Packets

The number of packets.

Protocol Options

The proxy options profile used by the policy. See Proxy Options.

Source Address

The addresses that a policy can receive traffic from. For more information, see Web cache policy address formats.

SSL Inspection

The SSL/SSH inspection options used by the policy. See SSL/SSH Inspection.

Status

Select to enable a policy or clear to disable a policy. A disabled policy is out of service.

Users

Which users the policy matches.

Video Filter

The video filter profile used by the policy. See Video Filter.

VPN Tunnel

The VPN tunnel used by the policy. See VPN.

Web Application Firewall

The web application firewall profile used by the policy. See .

Web Filter

The web filter profile used by the policy. See Web Filter.

ZTNA Tag

The ZTNA tags used in the ZTNA rule that is used by the policy. See Zero Trust Network Access introduction.

Change how the policy list is displayed

Policies can be added, edited, copied and pasted, moved, and deleted. To help organize your policies, you can also create sections to group policies together.

Policies can be inserted above or below existing policies and can also be disabled if needed.

The displayed policies can be filtered by either using the search field in the toolbar or by selecting the filter icon in a column heading. The available filter options vary depending on the type of data that the selected column contains.

How list order affects policy matching

The FortiProxy unit uses the first-matching technique to select which policy to apply to a communication session.

When policies have been added, each time the FortiProxy unit accepts a communication session, it then searches the policy list for a matching policy. Matching policies are determined by comparing the policy with the session source and destination addresses and the destination port. The search begins at the top of the policy list and progresses in order towards the bottom. Each policy in the policy list is compared with the communication session until a match is found. When the FortiProxy unit finds the first matching policy, it applies that policy and disregards subsequent policies.

If no policy matches, the session is accepted.

As a general rule, you should order the policy list from most specific to most general because of the order in which policies are evaluated for a match and because only the first matching policy is applied to a session. Subsequent possible matches are not considered or applied.

NOTE: Ordering policies from most specific to most general prevents policies that match a wide range of traffic from superseding and effectively masking policies that match exceptions.

Policy rules and authentication rules

Policy rules control what a user or user group can do. Authentication rules define how to authenticate a user. If a policy without a user group matches the type of traffic, authentication is not used because the user group was not specified in the policy.

For example, if a policy rule involving an explicit proxy has the Source field specifying an LDAP-based user group, any other policy rule referencing the explicit proxy is only matched if its Source field also specifies an LDAP-based group.

Move a policy

When more than one policy has been defined, the first matching policy is applied to the traffic session. You can arrange the policy list to influence the order in which policies are evaluated for matches with incoming traffic. See How list order affects policy matching for more information.

NOTE: Moving a policy in the policy list does not change its ID, which only indicates the order in which the policies were created.

To move a policy, click and drag the name to a new location. You can also move a policy by cutting and pasting it into a new location.

Copy and paste a policy

Policies can be copied and pasted to create clones. Right-click on the policy name and then select Copy from the pop-up menu. Right-click in the policy name that the new clone policy will be placed next to and select Paste Above or Paste Below to insert the new policy before or after the selected policy.

Policy views

In Policy & Objects policy list pages, there are three policy views: Interface Pair View, Sequence Grouping View, and By Sequence. For large policy tables (thousands of policies), the By Sequence view will load the fastest.

Interface Pair View displays the policies in the order that they are checked for matching traffic, grouped by the pairs of incoming and outgoing interfaces in collapsible sections. The Interface Pair View can be used when a policy is configured with multiple interfaces. Right-click on any pair name and click Expand All or Collapse All to expand or collapse all of the pairs.

By Sequence displays policies in the order that they are checked for matching traffic without any grouping.

In By Sequence or Sequence Grouping View view, policies can be moved by their policy ID before or after another specified policy ID.

To move a policy by policy ID:
  1. Go to Policy & Objects > Policy.

    Make sure By Sequence or Sequence Grouping View is selected at the top-right corner.

  2. Right-click the policy you want to move and select Move by ID.

    The Move by ID pane is displayed.

  3. Define the new location of the policy:

    1. Select whether the policy should be moved Above or Below the policy ID you will define in the next step.

    2. In the Destination policy ID field, enter the ID of the destination policy or select it from the dropdown menu.

  4. If you do not want to automatically view the new location of the policy, disable Jump to policy after move. This feature is enabled by default.

  5. Click OK.

    The policy will be moved to the new location.

New layout for policies NEW

A new layout is available for the policy list with the option to alternate between the new layout and the old layout. To switch between the Classic layout and New layout, select the style from the dropdown menu.

To change from the classic layout to the new layout:
  1. Go to Policy & Objects > Policy.

  2. Select the Classic layout dropdown menu.

  3. Select Use new layout. A confirmation message is displayed.

  4. Click Use new layout. The new layout is displayed.

The New layout includes several features to enhance user experience when using the Policy & Objects > Policy page:

  • The create, edit, and delete buttons are identified through icons instead of words. Selecting a policy also displays an inline menu with options to edit, delete, insert policies, and the option to show more options.

  • Right-click in Interface Pair View to Expand All or Collapse All sections.

  • A pane is used to create, edit, and insert policies instead of a separate page.

  • When a policy is inserted in Interface Pair View, the Incoming Interface and Destination Interface fields will be automatically filled. You can confirm the location of the new policy in the right-side gutter before clicking OK to insert the policy.

  • Multiple policies can be selected at once to efficiently work with a large number of policies.

  • When a single policy is selected, an inline menu opens below the row. The More dropdown menu includes the same expanded list of options that are available in the right-click menu.

  • When multiple policies are selected, the top menu bar changes to show buttons that are applicable to the multiple selections.

  • The view selector drop-down includes three options: Interface Pair View, Sequence Grouping View, and By Sequence. For large policy tables (thousands of policies), a tooltip will specify that the By Sequence view will load the fastest.

Policy lookup

Firewall policy lookup is based on the Source_interfaces/Protocol/Source_Address/Destination_Address that matches the source-port and dst-port of the protocol. Use this tool to find out which policy matches specific traffic from a number of policies. After completing the lookup, the matching firewall policy is highlighted on the policy list page.

The Policy Lookup tool has the following requirements:

  • Transparent mode does not support Policy lookup function.
  • When executing the policy lookup, you need to confirm whether the relevant route required for the policy work already exists.
To use the policy lookup:
  1. Go to Policy & Objects > Policy, click Policy Lookup.
  2. Select the incoming interface.
  3. Select IPv4 or IPv6 for the IP version.
  4. Enter the protocol number.
  5. Enter the source IP address.
  6. Enter the destination IP address or fully qualified domain name.
  7. Click Search to display the policy lookup results.

Web cache policy address formats

A source or destination address can contain one or more network addresses. Network addresses can be represented by an IP address with a netmask or an IP address range.

When representing hosts by an IP address with a netmask, the IP address can represent one or more hosts. For example, a source or destination address can be any of the following:

  • a single computer, for example, 192.45.46.45
  • a subnetwork, for example, 192.168.1.* for a class C subnet
  • 0.0.0.0 matches any IP address

The netmask corresponds to the subnet class of the address being added and can be represented in either dotted decimal or CIDR format. The FortiProxy unit automatically converts CIDR-formatted netmasks to dotted decimal format. Example formats:

  • netmask for a single computer: 255.255.255.255 or /32
  • netmask for a class A subnet: 255.0.0.0 or /8
  • netmask for a class B subnet: 255.255.0.0 or /16
  • netmask for a class C subnet: 255.255.255.0 or /24
  • netmask including all IP addresses: 0.0.0.0

Valid IP address and netmask formats include:

  • x.x.x.x/x.x.x.x, such as 192.168.1.0/255.255.255.0
  • x.x.x.x/x, such as 192.168.1.0/24
An IP address 0.0.0.0 with the netmask 255.255.255.255 is not a valid source or destination address.

When representing hosts by an IP address range, the range indicates hosts with continuous IP addresses in a subnet, such as 192.168.1.[2-10], or 192.168.1.*, to indicate the complete range of hosts on that subnet. You can also indicate the complete range of hosts on a subnet by entering 192.168.1.[0-255] or 192.168.1.0-192.168.1.255. Valid IP range formats include:

  • x.x.x.x-x.x.x.x, for example, 192.168.110.100-192.168.110.120
  • x.x.x.[x-x], for example, 192.168.110.[100-120]
  • x.x.x.*, for a complete subnet, for example: 192.168.110.*
  • x.x.x.[0-255] for a complete subnet, such as 192.168.110.[0-255]
  • x.x.x.0 -x.x.x.255 for a complete subnet, such as 192.168.110.0 - 192.168.110.255
You cannot use square brackets [ ] or asterisks * when adding addresses to the CLI. Instead you must enter the start and end addresses of the subnet range separated by a dash -. For example, 192.168.20.0-192.168.20.255 for a complete subnet and 192.168.10.10-192.168.10.100 for a range of addresses.

Policy

Policy

The policy list displays firewall policies in their order of matching precedence. Firewall policy order affects policy matching. For details about arranging policies in the policy list, see Change how the policy list is displayed.

You can add firewall policies that match HTTP traffic to be cached according to source and destination addresses and the destination port of the traffic.

Various right-click menus are available throughout the policy list. The columns displayed in the policy list can be customized, and filters can be added in a variety of ways to filter the information that is displayed. See Change how the policy list is displayed.

To view the policy list, go to Policy & Objects > Policy.

Hover over the leftmost edge of the column heading to display the Configure Table icon, which you can use to select the columns to display or to reset all the columns to their default settings. You can also drag column headings to change their order.

The following options are available:

Create New

Add a new policy. New policies are added to the bottom of the list. See Create or edit a policy.

Edit

Edit the selected policy. See Create or edit a policy.

Delete

Delete the selected policy.

Policy Lookup

Find a policy.

Search

Enter a search term to find in the policy list.

Export

Export the current view to CSV and JSON formats. Click Export and select CSV or JSON to download the file.

Interface Pair View/By Sequence

Select how to view the policy list:

  • Interface Pair View—Displays the policies in the order that they are checked for matching traffic, grouped by the pairs of Incoming and Outgoing interfaces. For instance, all of the policies referencing traffic from WAN1 to DMZ will be in one section. The policies referencing traffic from DMZ to WAN1 will be in another section. The sections are collapsible so that you only need to look at the sections with policies you are interested in.

  • By Sequence—Displays the policies in the order that they are checked for matching traffic without any grouping. The FortiProxy unit automatically changes the view on the policy list page to By Sequence whenever there is a policy containing the any interface. If the Interface Pair View is grayed out, one or more of the policies is using the any interface.

Type

The type of policy, such as Explicit Web, Transparent, or SSH Tunnel. See Policy types.

Name

The name of the policy.

Incoming Interface

The incoming interface or interfaces.

Outgoing Interface

The outgoing interface or interfaces.

Source

The source is the source address or source user of the initiating traffic.

Destination

The destination address or address range that the policy matches. For more information, see Web cache policy address formats.

Forwarding Server

The upstream forwarding server that the policy will forward traffic to.

Schedule

The time frame that is applied to the policy. See Schedules.

Service

The service or services chosen here represent the TCP/IP suite port numbers that will most commonly be used to transport the named protocols or group of protocols. See Services.

Action

The action to be taken by the policy, such as ACCEPT, DENY, REDIRECT, or ISOLATE.

Security Profiles

All the profiles used by the policy, such as AntiVirus, Web Filter, DLP Profile, ICAP, SSL Inspection, and Content Analysis options. See Security Profiles.

Log

The logging level of the policy. Options vary depending on the policy type.

Bytes

The number of bytes.

Applications、

Application names, application categories, and application groups that use the policy.

See Policy matching using applications for more details.

URL Category

URL categories that use the policy.

Active Sessions

The number of active sessions.

Application Control

What action is taken when an application matches.

AV

The antivirus profile used by the policy. See Antivirus.

Comments

Comments about the policy (up to 1023 characters).

Destination Address

The destination addresses that the policy matches. The destination address can be used as a traffic filter.

DNS Filter

The DNS filter profile used by the policy. See DNS Filter.

Email Filter

The email filter profile used by the policy. See .

Enforce ZTNA

Whether Zero Trust Network Access (ZTNA) is enabled or disabled. See Zero Trust Network Access introduction.

File Filter

The file filter profile used by the policy. See File Filter.

First Used

When the policy was first used.

Groups

Which groups the policy matches.

Hit Count

Number of results found.

ICAP

The ICAP profile used by the policy. See Create or edit an ICAP profile.

ID

The policy identifier. Policies are numbered in the order they are added to the configuration.

IPS

Which IPS signatures the policy uses.

Last Used

When the policy was last used.

Packets

The number of packets.

Protocol Options

The proxy options profile used by the policy. See Proxy Options.

Source Address

The addresses that a policy can receive traffic from. For more information, see Web cache policy address formats.

SSL Inspection

The SSL/SSH inspection options used by the policy. See SSL/SSH Inspection.

Status

Select to enable a policy or clear to disable a policy. A disabled policy is out of service.

Users

Which users the policy matches.

Video Filter

The video filter profile used by the policy. See Video Filter.

VPN Tunnel

The VPN tunnel used by the policy. See VPN.

Web Application Firewall

The web application firewall profile used by the policy. See .

Web Filter

The web filter profile used by the policy. See Web Filter.

ZTNA Tag

The ZTNA tags used in the ZTNA rule that is used by the policy. See Zero Trust Network Access introduction.

Change how the policy list is displayed

Policies can be added, edited, copied and pasted, moved, and deleted. To help organize your policies, you can also create sections to group policies together.

Policies can be inserted above or below existing policies and can also be disabled if needed.

The displayed policies can be filtered by either using the search field in the toolbar or by selecting the filter icon in a column heading. The available filter options vary depending on the type of data that the selected column contains.

How list order affects policy matching

The FortiProxy unit uses the first-matching technique to select which policy to apply to a communication session.

When policies have been added, each time the FortiProxy unit accepts a communication session, it then searches the policy list for a matching policy. Matching policies are determined by comparing the policy with the session source and destination addresses and the destination port. The search begins at the top of the policy list and progresses in order towards the bottom. Each policy in the policy list is compared with the communication session until a match is found. When the FortiProxy unit finds the first matching policy, it applies that policy and disregards subsequent policies.

If no policy matches, the session is accepted.

As a general rule, you should order the policy list from most specific to most general because of the order in which policies are evaluated for a match and because only the first matching policy is applied to a session. Subsequent possible matches are not considered or applied.

NOTE: Ordering policies from most specific to most general prevents policies that match a wide range of traffic from superseding and effectively masking policies that match exceptions.

Policy rules and authentication rules

Policy rules control what a user or user group can do. Authentication rules define how to authenticate a user. If a policy without a user group matches the type of traffic, authentication is not used because the user group was not specified in the policy.

For example, if a policy rule involving an explicit proxy has the Source field specifying an LDAP-based user group, any other policy rule referencing the explicit proxy is only matched if its Source field also specifies an LDAP-based group.

Move a policy

When more than one policy has been defined, the first matching policy is applied to the traffic session. You can arrange the policy list to influence the order in which policies are evaluated for matches with incoming traffic. See How list order affects policy matching for more information.

NOTE: Moving a policy in the policy list does not change its ID, which only indicates the order in which the policies were created.

To move a policy, click and drag the name to a new location. You can also move a policy by cutting and pasting it into a new location.

Copy and paste a policy

Policies can be copied and pasted to create clones. Right-click on the policy name and then select Copy from the pop-up menu. Right-click in the policy name that the new clone policy will be placed next to and select Paste Above or Paste Below to insert the new policy before or after the selected policy.

Policy views

In Policy & Objects policy list pages, there are three policy views: Interface Pair View, Sequence Grouping View, and By Sequence. For large policy tables (thousands of policies), the By Sequence view will load the fastest.

Interface Pair View displays the policies in the order that they are checked for matching traffic, grouped by the pairs of incoming and outgoing interfaces in collapsible sections. The Interface Pair View can be used when a policy is configured with multiple interfaces. Right-click on any pair name and click Expand All or Collapse All to expand or collapse all of the pairs.

By Sequence displays policies in the order that they are checked for matching traffic without any grouping.

In By Sequence or Sequence Grouping View view, policies can be moved by their policy ID before or after another specified policy ID.

To move a policy by policy ID:
  1. Go to Policy & Objects > Policy.

    Make sure By Sequence or Sequence Grouping View is selected at the top-right corner.

  2. Right-click the policy you want to move and select Move by ID.

    The Move by ID pane is displayed.

  3. Define the new location of the policy:

    1. Select whether the policy should be moved Above or Below the policy ID you will define in the next step.

    2. In the Destination policy ID field, enter the ID of the destination policy or select it from the dropdown menu.

  4. If you do not want to automatically view the new location of the policy, disable Jump to policy after move. This feature is enabled by default.

  5. Click OK.

    The policy will be moved to the new location.

New layout for policies NEW

A new layout is available for the policy list with the option to alternate between the new layout and the old layout. To switch between the Classic layout and New layout, select the style from the dropdown menu.

To change from the classic layout to the new layout:
  1. Go to Policy & Objects > Policy.

  2. Select the Classic layout dropdown menu.

  3. Select Use new layout. A confirmation message is displayed.

  4. Click Use new layout. The new layout is displayed.

The New layout includes several features to enhance user experience when using the Policy & Objects > Policy page:

  • The create, edit, and delete buttons are identified through icons instead of words. Selecting a policy also displays an inline menu with options to edit, delete, insert policies, and the option to show more options.

  • Right-click in Interface Pair View to Expand All or Collapse All sections.

  • A pane is used to create, edit, and insert policies instead of a separate page.

  • When a policy is inserted in Interface Pair View, the Incoming Interface and Destination Interface fields will be automatically filled. You can confirm the location of the new policy in the right-side gutter before clicking OK to insert the policy.

  • Multiple policies can be selected at once to efficiently work with a large number of policies.

  • When a single policy is selected, an inline menu opens below the row. The More dropdown menu includes the same expanded list of options that are available in the right-click menu.

  • When multiple policies are selected, the top menu bar changes to show buttons that are applicable to the multiple selections.

  • The view selector drop-down includes three options: Interface Pair View, Sequence Grouping View, and By Sequence. For large policy tables (thousands of policies), a tooltip will specify that the By Sequence view will load the fastest.

Policy lookup

Firewall policy lookup is based on the Source_interfaces/Protocol/Source_Address/Destination_Address that matches the source-port and dst-port of the protocol. Use this tool to find out which policy matches specific traffic from a number of policies. After completing the lookup, the matching firewall policy is highlighted on the policy list page.

The Policy Lookup tool has the following requirements:

  • Transparent mode does not support Policy lookup function.
  • When executing the policy lookup, you need to confirm whether the relevant route required for the policy work already exists.
To use the policy lookup:
  1. Go to Policy & Objects > Policy, click Policy Lookup.
  2. Select the incoming interface.
  3. Select IPv4 or IPv6 for the IP version.
  4. Enter the protocol number.
  5. Enter the source IP address.
  6. Enter the destination IP address or fully qualified domain name.
  7. Click Search to display the policy lookup results.

Web cache policy address formats

A source or destination address can contain one or more network addresses. Network addresses can be represented by an IP address with a netmask or an IP address range.

When representing hosts by an IP address with a netmask, the IP address can represent one or more hosts. For example, a source or destination address can be any of the following:

  • a single computer, for example, 192.45.46.45
  • a subnetwork, for example, 192.168.1.* for a class C subnet
  • 0.0.0.0 matches any IP address

The netmask corresponds to the subnet class of the address being added and can be represented in either dotted decimal or CIDR format. The FortiProxy unit automatically converts CIDR-formatted netmasks to dotted decimal format. Example formats:

  • netmask for a single computer: 255.255.255.255 or /32
  • netmask for a class A subnet: 255.0.0.0 or /8
  • netmask for a class B subnet: 255.255.0.0 or /16
  • netmask for a class C subnet: 255.255.255.0 or /24
  • netmask including all IP addresses: 0.0.0.0

Valid IP address and netmask formats include:

  • x.x.x.x/x.x.x.x, such as 192.168.1.0/255.255.255.0
  • x.x.x.x/x, such as 192.168.1.0/24
An IP address 0.0.0.0 with the netmask 255.255.255.255 is not a valid source or destination address.

When representing hosts by an IP address range, the range indicates hosts with continuous IP addresses in a subnet, such as 192.168.1.[2-10], or 192.168.1.*, to indicate the complete range of hosts on that subnet. You can also indicate the complete range of hosts on a subnet by entering 192.168.1.[0-255] or 192.168.1.0-192.168.1.255. Valid IP range formats include:

  • x.x.x.x-x.x.x.x, for example, 192.168.110.100-192.168.110.120
  • x.x.x.[x-x], for example, 192.168.110.[100-120]
  • x.x.x.*, for a complete subnet, for example: 192.168.110.*
  • x.x.x.[0-255] for a complete subnet, such as 192.168.110.[0-255]
  • x.x.x.0 -x.x.x.255 for a complete subnet, such as 192.168.110.0 - 192.168.110.255
You cannot use square brackets [ ] or asterisks * when adding addresses to the CLI. Instead you must enter the start and end addresses of the subnet range separated by a dash -. For example, 192.168.20.0-192.168.20.255 for a complete subnet and 192.168.10.10-192.168.10.100 for a range of addresses.