Skip to main content
Pixxxx
Pixxxx
New Member
June 25, 2012
Question

How to change network configuration of the direct connected interface

  • June 25, 2012
  • 3 replies
  • 4463 views
Dear all, I' m new to fortigate technologies so apologize me for the stupid questions; I have an HA installation of Fortigate 500A where two activities have to be done: 1. lan interface have two IP adresses and one have to be removed because the network has been dismissed see configuraztion: Fortigate-500A $ show system interface lan config system interface edit " lan" set ip X.X.X.190 255.255.0.0 set allowaccess ping https ssh config secondaryip edit 1 set allowaccess ping https ssh set ip 10.X.X.Y 255.255.252.0 next end next end I would like to reset the configuration as following config system interface edit " lan" set ip 10.X.X.Y 255.255.252.0 set allowaccess ping https ssh snmp next end is it possible without making outage? How can I reach the goal to remove secondary ip address and us it as primary removing old primary IP? if I use web interface inserting the secondary IP directly inside the configuration of the primary the goal will be achived or the system will tell me that I have already setted up this IP on the interface? please let me know how to make this changes 2. on lan interface I have to enable the SNMP request if using CLI I send the following command on secondary address it will be enough? or I have to tell to the system also the complete interface configuration? set allowaccess ping https ssh snmp so the question is, I can change usage of the interface without specify also the IP address of the interface using CLI? Thanks a lot in advance

    3 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    June 25, 2012
    hi, welcome to the forums. To change the primary IP to the value of the secondary, you have to: - first delete the secondary IP address - then change the primary to the secondary address I assume that all of your traffic will use the secondary at the moment (default gateway for the LAN, routing etc.). The bad news is that deleting the secondary will stop all traffic from your clients across the FGT. The good news is that changing the primary address will be effective immediately after pressing OK in the GUI. And as both IP addresses have used the same interface, thus the same MAC address, there won' t be any timeouts caused by a new MAC address. Same holds true if you use the CLI, doesn' t make any difference. Second question about SNMP: checking the SNMP checkbox in the interface config will only allow SNMP queries on that interface. SNMP configuration is done elsewhere in the GUI (setting communities, trap target etc.). Depends on your FortiOS version. This is clearly documented in the Admin Guide, though.
    Pixxxx
    PixxxxAuthor
    New Member
    June 25, 2012
    thanks for the info regarding the second question yes, I know that I have to made config using GUI, I have done it but now I have to enable request on the interface, and as I told you it is setted up on the second IP, so the question is can I change the allowaccess settings without makeing outage? I will use the following command using CLI: config system interface edit " lan" config secondaryip edit 1 set allowaccess ping https ssh snmp next end next end thanks in advance
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    June 25, 2012
    Through-traffic is independent of the ' allowaccess' settings. If you change the setting from the GUI you won' t even touch the HTTPS setting, and your access to the FGT.
    Pixxxx
    PixxxxAuthor
    New Member
    June 25, 2012
    sorry but I have to be more clear I have to change the ' allowaccess' settings for the secondary ip address, so, I can not do it using GUI I can change it using CLI with the command that I have posted in the previous post without affecting the all other interface settings or using CLI for changing the ' allowaccess' settings will affect the entire interface configuration? thanks and sorry for not understanding clearly
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    June 25, 2012
    You can use the CLI setting without affecting the primary IP address or the interface as a whole. Of course, the permissions for the secondary address can only be configured in the CLI, I didn' t think of that. My fault.
    Terms & ConditionsAccessibility statement