Kernaali ToolsHow it works
Each list becomes a union of inclusive address intervals. A sorted interval sweep computes A ∩ B, A \ B and B \ A; aligned power-of-two blocks turn each result into the smallest exact CIDR set. No individual addresses are enumerated. IPv4 and IPv6 use BigInt address arithmetic. Compare one family at a time.
Worked example
For the default lists, A ∩ B is 192.0.2.128/25 plus 198.51.100.0/25. Only A is 192.0.2.0/25; only B is 198.51.100.128/25. Each list covers 384 addresses, with 256 addresses shared. No gaps are filled.
Inputs, edge cases & common mistakes
An empty list is a valid empty set. Every nonblank line must contain one CIDR for the selected IP family; hosts need /32 or /128. Ranges and mixed families are rejected. Host bits are normalized and reported. Limits are 2,048 CIDRs and 200,000 characters per list, and 8,192 total output prefixes. An oversized exact result is rejected rather than widened. Address-set equality does not establish equivalent firewall policy, next hops or VPN negotiation.
Read the relationships correctly
Two canonical CIDR blocks from the same address family are disjoint, equal or nested. Partial coverage in this report describes one block against the union of the other list, not two partly overlapping canonical blocks. Duplicates and contained networks within each list are reported separately. A list can fully cover a block using several smaller CIDRs.
Use it before a network change
Put the current VPN selectors in A and the proposed selectors in B. The intersection is unchanged address coverage, A-only is removed coverage and B-only is newly included coverage. Review device-specific selector and policy behavior separately. The same comparison helps find address objects missing from a migration.
For example, A = 2001:db8:42::/126 and B = 2001:db8:42::2/127 share 2001:db8:42::2/127. Only A is 2001:db8:42::/127 and only B is empty.
To reduce a single route list, use exact aggregation and route summarization. Its covering-supernet mode is a separate operation that can introduce additional space. After reviewing IPv4 sets, prepare FortiGate address objects.
Technical references
Found an issue? Send a correction with a reproducible example.