NetCrosswalk: Cross-Vendor Network Task Translator

Steps

1. GUI: IP → Addresses → + → *Address* 192.168.10.1/24, *Interface* ether2.
2. CLI: /ip address add address=192.168.10.1/24 interface=ether2
3. Verify: /ip address print

Gotchas & notes

• In RouterOS an IP is a separate object attached to an interface, not a property of it. That means one interface can hold many addresses with no extra syntax — handy, and a surprise if you expect one IP per port.
• You must specify the address with a prefix length (/24); RouterOS derives the network automatically.
• Adding an address to an interface that is part of a bridge does nothing useful — put the address on the bridge interface instead. This is the most common early RouterOS mistake.
• The D flag means dynamic (from a DHCP client or PPP); you cannot edit those, you change the client config instead.

Steps

1. GUI: Network → Interfaces → edit the interface → *Addressing mode* Manual → *IP/Netmask* 192.168.10.1/24. Set *Role* and, importantly, the Administrative Access checkboxes.
2. CLI: config system interface → edit "port2" → set mode static → set ip 192.168.10.1 255.255.255.0 → set allowaccess ping https ssh → next → end
3. Verify: get system interface physical or diagnose ip address list

Gotchas & notes

• allowaccess is set here and nowhere else. Forget it and you can reach the subnet but not ping or manage the FortiGate on that interface — and no firewall policy will fix it, because local-in traffic is not policy-controlled.
• An interface already referenced by a policy, route, or VIP cannot be changed or deleted until every reference is removed. FortiOS reports which object is holding it — read that error rather than fighting it.
• One IP per interface; for more, create secondary IPs (set secondary-IP enable then config secondaryip) or use VLAN sub-interfaces.
• Setting *Role* (LAN/WAN/DMZ) only changes which fields the GUI shows — it has no functional effect, but it does hide options you may be looking for.

Steps

1. You do not configure interface IPs directly — you create a Network: Settings → Networks → Create New Network.
2. Set *Name*, *Router IP / Gateway* (e.g. 192.168.10.1/24), and the VLAN ID if it is tagged.
3. Save; the gateway provisions and the SVI is created for you.

Gotchas & notes

• UniFi's model is network-centric, not interface-centric: you define a subnet+VLAN and the controller decides where to put it. Coming from any CLI platform this is the biggest mental adjustment.
• The gateway IP you enter becomes both the interface address and the DHCP-advertised gateway; there is no way to separate them.
• Changing a network's subnet re-provisions the gateway and invalidates existing DHCP leases — clients need to renew, so it is not a no-impact edit.
• WAN interface addressing is configured separately under Settings → Internet.

Steps

1. Routed port: interface GigabitEthernet0/1 → no switchport (on a switch) → ip address 192.168.10.1 255.255.255.0 → no shutdown
2. SVI on a switch: interface Vlan10 → ip address 192.168.10.1 255.255.255.0 → no shutdown (and ensure VLAN 10 exists and ip routing is on)
3. Save: copy running-config startup-config
4. Verify: show ip interface brief

Gotchas & notes

• no shutdown is required — a newly configured interface on a router is administratively down by default and shows administratively down in show ip interface brief.
• On a Layer 3 switch, an SVI stays down unless the VLAN exists in the VLAN database and at least one access/trunk port in that VLAN is up. A correctly configured SVI showing down/down usually means no active member port.
• ip routing must be enabled globally on a Layer 3 switch or SVIs will not route between each other — the interfaces come up and nothing passes.
• Subnet mask in dotted-decimal here, wildcard mask in ACLs and OSPF network statements on the same device.

Steps

1. Network → Interfaces → Ethernet → click the interface → *Interface Type* Layer3.
2. On the Config tab set the Virtual Router and the Security Zone (create them if needed).
3. On the IPv4 tab add 192.168.10.1/24.
4. Optionally attach an Interface Management Profile (Advanced tab) to permit ping/SSH/HTTPS to this interface.
5. Commit.

Gotchas & notes

• An interface with an IP but no zone passes no traffic, and one with no virtual router does not route. These three settings (type, zone, VR) are mandatory together — configuring only the IP is the single most common PAN-OS onboarding error.
• Management access to a dataplane interface requires an Interface Management Profile; without it the interface will not even answer ping. This is PAN-OS's equivalent of FortiGate's allowaccess.
• Never attach a management profile that permits HTTPS/SSH to an untrusted interface without restricting *Permitted IP Addresses* on it.
• Requires a Commit, and interface-type changes can bounce the link.

Steps

1. Interfaces → Interface Assignments to map a NIC (or VLAN) to a friendly interface first, if it is not already assigned.
2. Interfaces → <NAME> → tick *Enable*, set *IPv4 Configuration Type* Static IPv4, then *IPv4 Address* 192.168.10.1 /24.
3. Save → Apply Changes.
4. Add firewall rules for the new interface — it has none, so it is fully blocked.

Gotchas & notes

• A newly assigned interface has an empty ruleset and therefore blocks everything, including DNS and pings to the firewall. Nothing works until you add pass rules — unlike LAN, which ships with an allow-all rule.
• Leave the *IPv4 Upstream gateway* field as none on internal interfaces. Setting a gateway there turns it into a WAN-like interface and changes NAT and routing behaviour.
• The interface must be assigned before it appears in menus; unassigned NICs are invisible in Interfaces → <name>.
• Renaming an interface updates rule references automatically, but any alias or package config referring to it by the old name may not follow.

Steps

1. GUI: Network → Interfaces, click the pencil/edit icon on the target interface (e.g. X0) → set *Zone* (e.g. LAN) → *IP Assignment* Static → enter *IP Address* and *Subnet Mask* → OK.
2. For a VLAN sub-interface the same edit dialog is used after the VLAN interface exists (see the VLAN task) — the IP fields work identically.
3. CLI (E-CLI, SSH or console): configure → interface "X0" → zone LAN → ip assignment static → ip address 192.168.1.1 → ip subnet-mask 255.255.255.0 → exit → commit.
4. Verify: GUI Network → Interfaces summary table, or CLI show interface X0.

Gotchas & notes

• An interface with no zone assigned ("Unassigned") will take an IP but pass no traffic — there are no default Access Rules for it. Coming from platforms where an interface just works once addressed, this is the step people forget.
• If you re-IP the interface you're currently managing through, HTTPS/HTTP management access is tied to the zone's *Management* checkboxes, not the address itself — losing that checkbox on the new subnet locks you out immediately.
• Exact E-CLI token names (ip assignment vs ip-assignment, etc.) have shifted between SonicOS 7 minor releases; treat the sequence above as representative and confirm against the CLI Reference Guide for your exact build before scripting it.
• This is one of the few areas where the CLI genuinely mirrors the GUI — SonicWall documents it explicitly as bootstrap/initial-setup territory.

Steps

1. GUI (router/gateway, Insight-managed): Insight portal → select the device → Configure → LAN Settings to set the LAN IP/subnet, or Configure → Internet Settings for a static WAN IP. This is app/cloud only — there is no local page and no CLI on the router itself.
2. GUI (Insight-managed or standalone switch with L3 capability): local switch GUI → Routing → VLAN Routing Interface → Add → pick VLAN, enter IP address and subnet mask. On Insight-managed switches this can also be pushed from Insight portal → device → Routing.
3. CLI (fully-managed M4200/M4300 only, console or SSH): configure → interface vlan 10 → ip address 10.0.10.1 255.255.255.0.
4. Verify: show ip interface vlan 10 (M4200/M4300 CLI) or the Routing status page in the switch GUI.

Gotchas & notes

• Insight-managed routers and Orbi Pro APs have zero local admin UI and zero CLI for this — if the Insight cloud service is unreachable, you cannot change a LAN/WAN IP at all short of a factory reset.
• Most NETGEAR Smart Switches are Layer 2 only: 'assign an IP to an interface' there really means the single out-of-band management IP (set via Insight or the local GUI), not per-VLAN routed interfaces.
• Only the M4200/M4300 line does real inter-VLAN routing with distinct IPs per VLAN interface, and only that line has a CLI command for it — so whether this task even has a CLI path depends entirely on which box you're touching.
• Static WAN IP on an Insight router is buried under Internet Settings, not LAN Settings — easy to look in the wrong place coming from a platform that treats all interfaces uniformly.