Changing Address Object Associated-Interface settings breaks configuration
I have a Fortigate FGT200F running 7.4.11.
It has a large number of physical connections that I’d like to rationalize down to VLAN interfaces on a trunk of multiple 10G lines. As such, the “names” of many of my networks are going to change from “portx” to “some-name-I-pick”. This has follow-on consequences for firewall objects and policies. Naturally, I don’t really want to delete all my policies and objects to get this done.
Many of the objects are tied to associated-interfaces. To ease the migration, I tried as a first step to reconfigure the objects by removing the “set associated-interface” command from each object in a backup of the config, then restoring the altered backup.
The firewall accepted the altered configuration and booted, however it permitted no traffic to traverse any policies while in this state. During this time it logged errors such as
action="connect" status="failure" reason="SSL accept failed" msg="40B84138E57F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:ssl/record/rec_layer_s3.c:911:SSL alert number 46
Reviewing the diff between the backup and altered backup confirmed that the only lines that diff sees as changed are the replacement of the “set associated-interface bwah” with blank lines.
Running a flow trace on the firewall in this state showed the firewall was recognizing the incoming traffic properly, associating it to the correct interface, finding the correct egress route, but then denying it on policy id 0 anyways. This was examined specifically on a traffic rule which did not include a molested object.
Reverting to the unmolested copy of the backup returned the firewall to service.
Can anyone tell me why making this apparently simple change completely broke the traffic handling?
Thank you for your time.
