Cannot delete VPN due to Name morphing by KEEPASS

9 replies
16386 views

It appears as if when I tried to edit an IPSEC-VPN phase1 entry in the GUI, the name for some reason received my login-name from my KeePass running in the background. That ended up in completely messing that VPN up. I cannot delete this VPN right now although there are 0 references shown on the side. All attempts doing this from the CLI failed (I' m quite sure its due to syntax issues on my side). Can anyone please give a hand? Thanks!

gilfalkoAuthor

New Member

This to be exactly is my problem: edit " Emind_VPN" set vdom " root" set type tunnel set snmp-index 25 set interface " port16" next and edit " gilfalko" set interface " port16" set dhgrp 2 set proposal aes128-sha1 set remote-gw SOMEIPGOESHERE set psksecret ENC BLABLABLABLAKEY next I must remove both delete command simply throws out a : A tunnel interface cannot be deleted directly. command_cli_delete:5271 delete table entry Emind_VPN unset oper error ret=-160 Command fail. Return code -160

ede_pfau

SuperUser

Reason for this behavior is just exactly what the error message says. You cannot delete a virtual tunnel interface directly. Instead, delete phase2 and then phase1 of your VPN. In order to be able to do this, you must delete all policies in which this phase1 is used as a (virtual) interface. After deleting phase1, the virtual interface will vanish automatically (under Network > Interfaces).

gilfalkoAuthor

New Member

My friend, I' m about to shock you. There' s absolutely NO Phase 2 or Policies referencing to this VPN. I have saved my settings as backup and searched it all for " gilfalko" and " emind_vpn" . All I have found are the lines I posted here. No routes. No policies. One more thing, this VPN INTERFACE does NOT appear on the Network --> Interfaces screen.

gilfalkoAuthor

New Member

ede_pfau

SuperUser

don' t worry, nothing really can shock me...I' m on holidays So you have got left a phase1 called ' gilfalko' . What is the error message if you try to delete it, from GUI and/or from the CLI? In your first screenshot, if you tick the ' gilfalko' entry, does ' Delete' appear? If not, how many references are displayed?

gilfalkoAuthor

New Member

Holidays? Israeli? :) Anyway, This is what I get when attempting to delete " gilfalko" from command line: This phase1-interface is currently used command_cli_delete:5271 delete table entry gilfalko unset oper error ret=-23 Command fail. Return code -23 When attempting to delete from GUI (Delete button does appear) I get a " Entry is used" . I might as well mention that when attempting to edit " gilfalko" without actually editing and just pressing the OK button I get a " CFG_SYS_ERROR"

rwpatterson

New Member

The FGT is holding it somewhere. Reboot and delete it. Been there, done that. I' m on vacation as well, but not Israeli. ;)

ede_pfau

SuperUser

Try to reboot, and if the error persists, look up the ' ref count' column. If >0, you can click the number to be shown where the entry is still used. That is, in 4.3 and higher. You could do the backup-edit-restore trick as a last resort. This is one of the moments where a cluster really counts. No Israeli either, but self-employed (= self-exploiting). Last week of our summer school holidays.

Sign up

Login with SSO

Login to the community

Login with SSO