Technical Tip: Errors encountered in changing from NAT to transparent mode

Description

This article describes how to switch from NAT to transparent mode without any errors.

Scope

FortiGate.

Solution

Error 1: When switching from NAT mode to Transparent mode, and 'FortiLink' has already been configured, the following error appears:

FGT # config sys settings

FGT (settings) # set opmode transparent
Cannot change to Transparent mode because this vdom contains managed switches and switchctl-vlans.
Please clear managed-switches, disable fortilink and retry.
node_check_object fail! for opmode transparent

value parse error before 'transparent'
Command fail. Return code -7610

To change the operation mode of the unit, use the following command:

FGT (fortilink) # show
    config system interface
        edit "fortilink"
            set vdom "root"
            set allowaccess ping fabric
            set status down
            set type aggregate
            set lldp-reception enable
            set lldp-transmission enable
            set snmp-index 14
       next
end

Even after disabling the FortiLink interface, the same error message should still appear. If FortiLink has any referenced configurations, remove them using the following CLI commands:

show | grep -i fortilink -f

config system interface

    edit "fortilink" <---

        set vdom "root"

        set fortilink enable <---

        set ip 10.10.225.1 255.255.255.0

        set allowaccess ping fabric https

        set type aggregate

        set lldp-reception enable

        set lldp-transmission enable

        set snmp-index 8

    next

end

config system ntp

    set ntpsync enable

    set server-mode enable

    set interface "fortilink" <---

end

config system dhcp server

    edit 1

        set ntp-service local

        set default-gateway 10.10.225.1

        set netmask 255.255.255.0

        set interface "fortilink" <---

        set vci-match enable

        set vci-string "FortiSwitch" "FortiExtender"

    next

end

config switch-controller storm-control-policy

    edit "auto-config"

        set description "storm control policy for fortilink-isl-icl port" <---

        set storm-control-mode disabled

    next

end

References can also be checked using the following cmdb command:

diagnose sys cmdb refcnt show system.interface.name fortilink

entry used by table system.dhcp.server:id '1'

entry used by child table interface:interface-name 'fortilink' of complex system.ntp:interface.interface-name

Disabling the NTP server which lists FortiLink interface (or switch interface to any other interface available):

config sys ntp

FortiGate(ntp) # show

config system ntp

    set ntpsync enable

    set server-mode enable

    set interface "fortilink"

end

(ntp) # set server-mode disable

(ntp) # end

Delete the DHCP server entry using the following commands:

config sys dhcp server

(server) # delete 1

(server) # end

Disable FortiLink interface:

config sys interface

(interface) # edit fortilink

(fortilink) # set stat down

(fortilink) # end

On FortiGate-VM, it can be desired to delete the FortiLink interface as well:

config sys interface

(interface) # delete fortilink

(interface) # end

Try to change the mode to Transparent mode using the following CLI commands:

config sys settings

(settings) # set opmode transparent

(settings) # set manageip 10.12.12.12/24

(settings) # end

Changing to TP mode

Done.

Go to System -> Settings -> NTP. Also, on the aforementioned FortiLink configuration, unset the IP address and disable all configurations related to FortiLink as shown in the screenshot below.

Error 2: Another error that can be encountered when objects are referenced:

FGT # config sys settings

FGT (settings) # set opmode transparent

   Paired npu0_vlinks with up status in the same VDOM(TP mode) are not allowed
   node_check_object fail! for opmode transparent

   value parse error before 'transparent'
   Command fail. Return code -651

The reference can be any interface. In this case, the issue is on the vdom link. Disable the VDOM links by going to the respective link:

   FGT # config system interface

           edit <interface>
              set status disable

           next

         end

Below is the expected result without any error message:

FGT # config system settings

FGT (settings) # show full-configuration | grep opmode
set opmode nat

FGT (settings) # set opmode transparent

FGT (settings) # set manageip <IP address/mask>

FGT (settings) # end

Output: 

FGT # config system settings

FGT (settings) # show full-configuration | grep opmode
    set opmode transparent

FGT (settings) # end