Skip to main content
Giovanna
Explorer II
June 19, 2026
Question

Edit interface name on fortigate with High Availability Configuration

  • June 19, 2026
  • 3 replies
  • 72 views

Hi , would like to ask if there is a way to edit interface name on fortigate. In particular in configuration of 4 fortigates  with High Availability, where one is master other slaves. If in this configuration the method used to change interface name is to download backup configuration file of master FW edit the configuration file and load it with interface name changes, would this be a correct approach? Or maybe something should be done also on the slaves configuration? Or the best way would be to delate interface and re do it with the new name?

 

Many thanks!

3 replies

Yurisk
SuperUser
SuperUser
June 19, 2026

In general, any configuration not specific to HA settings (like HA interfaces in your case) can and should be changed from the active member only, no need to do changes on the slaves (and not advised - it would for sure get them out of sync). 

On the other hand - what do you mean by changing int names? That is, you cannot change names of physical interfaces (port1 will stay port1), only logical ints like VLAN - but if you already have rules using such interfaces it will not allow you to change it as being in use (unless there is a change in latest & greatest FortiOS version 7.6, 8.0). 

yurisk.info - all things Fortinet blog, no ads
Yurisk
SuperUser
SuperUser
June 19, 2026

If such int is not in use - just change the name in the GUI, no need to reload config (and cluster) for that.

yurisk.info - all things Fortinet blog, no ads
christian_89_
Explorer II
June 19, 2026

One correction to the above, because it changes your plan. In current FortiOS you cannot rename a normal interface once it has been created. That applies to physical ports, VLANs, aggregates, loopbacks, hardware switches and so on, in both the GUI and the CLI, whether the interface is in use or not. The name field is read-only after creation, and config system interface rename does not work for these types. This has not changed in 7.6 or 8.0, so "rename the unused VLAN in the GUI" will not work on a current build.

There is exactly one exception, and it is new in 8.0: IPsec tunnel interfaces can now be renamed natively, and the references update automatically.

config vpn ipsec phase1-interface
rename <old> to <new>
end

This applies only to phase1-interface, not to physical ports or VLANs. So if what you are renaming is an IPsec tunnel and you are on 8.0, this is the clean way. For anything else, read on.

For normal interfaces you have a few real options, from zero impact to most disruptive:

Alias. If all you want is a friendlier name to recognise the interface, set an alias. It is display only, shows in the GUI, has no in-use restriction, needs no reload and does not disrupt the cluster. On HA you set it on the primary and it syncs down. For most people this is what they actually want.

 

 

config system interface
edit "<interface>"
set alias "<friendly-name>"
next
end

Zone. If the goal is cleaner policy references rather than the interface object itself, put the interface in a zone and reference the zone in your policies. The interface name stays as is.

Edit the config backup and restore. This is the only way to truly change a normal interface name, and your approach is the correct method, with two conditions. First, replace every occurrence of the old name in the file, not just the interface definition but also every policy, route, address object, DHCP server, VIP and zone that references it, or the restore will fail or drop those references. Second, in HA you restore the edited config to the primary only. That restore reboots the unit, which triggers a failover to a secondary, and once it comes back the new config syncs to the whole cluster. Treat it as a maintenance window.

Delete and recreate. Only worth it for an interface with few or no references, since you must remove every reference first, which means downtime, and it is more error prone than the config edit for anything in use.

To answer your three questions directly:

Editing the master backup and reloading is a valid method for an actual rename of a normal interface. Restore it to the primary only, with all references updated, and expect a reboot plus failover.

Nothing should be done on the secondaries. Never edit them directly. The primary syncs to them, and touching the secondary config is exactly what puts the cluster out of sync. After the change, confirm with get system ha status and diagnose sys ha checksum cluster.

Delete and recreate is the least attractive option for an in-use interface. If you only need a clearer name, do not rename at all, use an alias.

One useful command before you delete or edit anything: diagnose sys checkused system.interface.name <name> lists every place the interface is referenced, so you know exactly what you are touching.

CFR_
Yurisk
SuperUser
SuperUser
June 20, 2026

Correct, by “changing interface name” i should have said “if not used - delete and create again with the new name”

yurisk.info - all things Fortinet blog, no ads
christian_89_
Explorer II
June 20, 2026

Exactly right, and thanks for circling back. For an unused interface, delete and recreate is the clean path. The only thing I would add is to run diagnose sys checkused system.interface.name <name> first to confirm it genuinely has no references, since the GUI will block the delete while anything still points at it, and on the cluster do the delete and recreate on the primary so it syncs down to the secondaries. Good thread.

CFR_