Skip to main content
evince
evince
New Member
November 14, 2014
Question

GRE tunnel, modify remote-gateway

  • November 14, 2014
  • 8 replies
  • 21740 views

Hi all,

 

I'm running several gre tunnels, all is working perfect. By the way i'd like to modify 1 remote-gateway. I've tried via CLI but i get an error :

unexpected to change gateway address! attribute set operator error, -61, discard the setting

 

Here is the config :

FGVM-ITX (gre-vince-test) # show config system gre-tunnel

edit "gre-vince-test"

set interface "port10"

set remote-gw xxx.xxx.xxx.xxx ==> IP i need to change

set local-gw zzz.zzz.zzz.zzz

next

end

 

Do you have any idea?

 

Thank you in advance,

 

Bests Regards,

    8 replies

    emnoc
    emnoc
    New Member
    November 14, 2014

    I don't think you can modify the tunnel entries after it's configured. You can edit  a save cfg file  and then do a restoral.

     

     

     

    norouzi
    norouzi
    New Member
    November 14, 2014

    or delete the tunnel and create it again.

    evince
    evinceAuthor
    New Member
    November 14, 2014

    Dear all,

     

    Thank you for your help. It's a bad new, this firewall is in production and i can not reboot it as i want. I have a lot of policies so it is impossible to delete and renew the tunnel :(

    norouzi
    norouzi
    New Member
    November 14, 2014

    In this case the best way is changing your configuration from backup and restore it as emnoc said.

     

    evince
    evinceAuthor
    New Member
    November 14, 2014

    Ok thank you very much.

    emnoc
    emnoc
    New Member
    November 14, 2014

    Keep in mind  a configuration  restoral is going cause a reboot.

     

    I think another trick would be o place the interface into a zone before you nail policies and then you add the new GRE tunnel into the same zone and delete the old one. But that would also require you to "remove" all policies in your case.

     

    e.g

     

    config system zone     edit "mytunnel"         set interface "tun1" "tun2"     next end

     

    and

    config system gre-tunnel     edit "tun1"         set remote-gw 199.111.111.1         set local-gw 10.10.80.1     next     edit "tun2"         set remote-gw 199.111.111.2         set local-gw 10.10.80.1     next end

     

    But once you place these into a tunnel, you can  nail  a policy to just one tunnel, but it will allow you to add or remove tunnels if the need comes up. You don't have to 1+ interfaces in a zone, So you could place one member ( tun1 ) and then if tun1 ever needs to change, you add tun2 and delete tun1.

     

    Either way, it's not a simple  1 2 3 , but with proper planning you can eliminate most of the hassle. And I wish Fortinet would remove this restriction and allow you to re-edit the gw ip_address

     

    YMMV

    evince
    evinceAuthor
    New Member
    November 14, 2014

    Hello emnoc,

     

    Thank you for your great help. Your idea about creating a zone looks wondurful for my situation. I think i'll do that :)

     

    As you said, Fortinet should remove this restriction, it is a non-sense.

     

    Bests Regards,

     

    Vincent.

     

     

    netgeek1
    netgeek1
    New Member
    December 13, 2018
    I know this is an old post, but I searched everywhere and was unable to find an answer that didn't require rebooting a production device, so here is the solution (steps 12-14 are done on a FortiManager, so ignore if you don't have one):

     

    1. SSH to device (or connect to the console).

     

    2. Find all references to tunnel name in configuration. For this example we will use "Zscaler_LON3" for the tunnel. We are changing the remote-gw IP from 145.8.20.36 to 145.8.21.246.

     

     FG-FW01 # sh full-configuration | grep -f Zscaler_LON3

     config system interface

          edit "Zscaler_LON3" <---

               set vdom "root"

               set distance 5

               ...

          next

     end

     config system gre-tunnel

          edit "Zscaler_LON3" <---

               set interface "wan1"

               set remote-gw 145.8.20.36

               set local-gw 25.125.46.4

               set dscp-copying disable

               set keepalive-interval 0

          next

     end

     config firewall policy

          edit 418

               set name ''

               set srcintf "port3"

               set dstintf "Zscaler_LON3" <---

               set srcaddr "all"

               set dstaddr "ext.grp.denyall.malicious"

     

    3. Take a full copy of ALL returned examples.

     

    4. Create a new GRE tunnel with "-bk" at the end and garbage IPs.

     

     config system gre-tunnel

          edit "Zscaler_LON3-bk"

               set interface "wan1"

               set remote-gw 1.1.1.254

               set local-gw 1.1.1.211

               set dscp-copying disable

               set keepalive-interval 0

          next

     end

        

    5. Modify all references from original tunnel "Zscaler_LON3" to new tunnel "Zscaler_LON3-bk"

     

     config firewall policy

          edit 418

               set dstintf "Zscaler_LON3-bk"

          next

     end

     config router static

          edit 36

               set device "Zscaler_LON3-bk"

          next

     end

     config router policy

          edit 4101

               set output-device "Zscaler_LON3-bk"

          next

     end

     config system link-monitor

          edit "Zscaler_LON3_Probe"

               set srcintf "Zscaler_LON3-bk"

          next

     end

        

    6. Do another 'sh full-configuration | grep -f <tunnel-name>' and verify the only references to the original tunnel "Zscaler_LON3" are under 'config system interface' and 'config system gre-tunnel'.

     

    7. Delete original GRE tunnel then recreate with new IP address.

     

     FG-FW01 (gre-tunnel) # delete Zscaler_LON3

     FG-FW01 (gre-tunnel) # end

     FG-FW01 # conf sys gre-tunnel

     FG-FW01 (gre-tunnel) #      edit "Zscaler_LON3"

     new entry 'Zscaler_LON3' added

     FG-FW01 (Zscaler_LON3) #         set interface "wan1"

     FG-FW01 (Zscaler_LON3) #         set remote-gw 145.8.21.246

     FG-FW01 (Zscaler_LON3) #         set local-gw 25.125.46.4

     FG-FW01 (Zscaler_LON3) #         set dscp-copying disable

     FG-FW01 (Zscaler_LON3) #         set keepalive-interval 0

     FG-FW01 (Zscaler_LON3) #     next

     FG-FW01 (gre-tunnel) # end

        

    8. Deleting the GRE tunnel has also deleted all information from the system interface, you need to add it all back in. Make sure to set the 'set remote-ip' to the new remote-gw address "145.8.21.246".

     

     FG-FW01 (interface) # edit Zscaler_LON3

     

     FG-FW01 (Zscaler_LON3) # show

     config system interface

          edit "Zscaler_LON3"

               set vdom "root"

               set type tunnel

               set snmp-index 34

               set interface "wan1"

          next

     end

     FG-FW01 (Zscaler_LON3) #         set vdom "root"

     FG-FW01 (Zscaler_LON3) #         set distance 5

     FG-FW01 (Zscaler_LON3) #         set dhcp-relay-service disable

     FG-FW01 (Zscaler_LON3) #         set ip 172.18.100.89 255.255.255.255

     ...

     FG-FW01 (Zscaler_LON3) #         set status up

     ...

     FG-FW01 (Zscaler_LON3) #         set remote-ip 145.8.21.246

     ...

     FG-FW01 (Zscaler_LON3) #     next

     

    9. Modify all references from new tunnel "Zscaler_LON3-bk" to original tunnel "Zscaler_LON3"

     

     config firewall policy

          edit 418

               set dstintf "Zscaler_LON3"

          next

     end

     config router static

          edit 36

               set device "Zscaler_LON3"

          next

     end

     config router policy

          edit 4101

               set output-device "Zscaler_LON3"

          next

     end

     config system link-monitor

          edit "Zscaler_LON3_Probe"

               set srcintf "Zscaler_LON3"

          next

     end

        

    10. Do another 'sh full-configuration | grep -f <tunnel-name>' and verify the only references to the new tunnel "Zscaler_LON3-bk" are under 'config system interface' and 'config system gre-tunnel'.

     

    11. Delete the new tunnel "Zscaler_LON3-bk", then do another check to make sure all references are removed.

     

    12. Do a 'Retrieve Config' from inside Device Manager -> Configuration Revision History and save the configuration.

     

    13. Do a 'Revision Diff' and validate your change.

     

    14. The policy will probably show RED for out-of-sync. If so, do a policy push even though it shows no changes.

     

    Terms & ConditionsAccessibility statement