Troubleshooting Tip: Error '-9999' when changing remote gateway type of an IPsec tunnel
| Description | This article describes how to fix Error '-9999: -9999', which appears when trying to change the Remote Gateway type of an IPsec tunnel on the GUI or CLI. In this example, an attempt was made to change the Remote Gateway from static to Dynamic DNS under an IPsec tunnel 'SiteA'.
|
| Scope | FortiGate v7.2.0 and later. |
| Solution | This is an expected behavior in v7.2.0 and later. The IPsec phase 1 interface type cannot be changed after it is configured. This is due to the tunnel ID parameter (tun_id), which is used to match routes to IPsec tunnels to forward traffic. If the IPsec phase 1 interface type needs to be changed, a new interface must be configured. Here is a related article on how to reconfigure the IPSEC and change the tunnel type:
Note: This is only applicable to Route-based IPsec VPN. Changing of the remote gateway is still possible with a Policy-based IPsec VPN. Refer below to learn more about the difference between the two.
Related document: |
