Troubleshoot Policy Deployment Failure with Netmask Error after Software Upgrade

Available Languages

Download Options

  • PDF     (15.8 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (83.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (68.8 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 23, 2026
Document ID:226025

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Issue

After software upgrade on the Secure Firewall Threat Defense (FTD), the policy deployment fails with this error in the deployment transcript:

FMC >> ip local pool vpnpool1 192.0.2.1-192.0.2.30 mask 255.255.225.224
firewall >> info : Invalid Netmask: Netmask is not contiguous

The deployment is failing due to discontiguous network mask 255.255.225.224, specifically the third octet of the mask is discontiguous.

Environment

  • FMC-managed Firepower 2110 running FTD. Other hardware platforms and ASA software can also be affected.

  • First seen after the software upgrade to version 7.4.4. Other target versions can also be affected.

  • The firewall is configured with remote access Virtual Private Network (VPN) and a locally defined IP pool.

Resolution

The deployment is successful after configuring a contiguous network mask.

Cause

The deployment fails due to attempt to configure discontiguous network masks. This is an expected behavior introduced as part of Cisco bug ID CSCwm37455, where the software includes additional validation that disallows the configuration of local IP pools with discontiguous network masks. This software defect is fixed in software release 7.4.3 and later releases within the 7.4.x series.

Related Content

Revision History

Revision Publish Date Comments
2.0
23-Oct-2026
Recertification
1.0
12-Jun-2026
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Ilkin Gasimov
    Cisco TAC Engineer
  • Mikis Zafeiroudis
    Cisco TAC Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products