How to remove a wrong command in Fortigate firewall without rebooting it

Forum|Forum|4 years ago
February 9, 2022
4 replies
29220 views

I have a firewall with a wrong command in the config, I am exploring whether I can correct it without rebooting the firewall.

The following syntax is in the Fortigate firewall. However, the command "set associated-interface "Terminal10" in red is wrong, it should not be there. Can the wrong command be removed by CLI without restoring the firewall config file? Restoration will cause disruption to the firewall operation as there will be rebooting. Appreciate your advice. Thanks.

edit "Terminal_192.168.1.1"
set associated-interface "Terminal10"
set comment "Terminal_192.168.1.1"
set subnet 192.168.1.1 255.255.255.255
next

After the removal, it becomes as follows:

edit "Terminal_192.0.132.1"
set comment "Terminal_192.168.1.1"
set subnet 192.168.1.1 255.255.255.255
next

FortiGate

Best answer by yktee99

Debbie_FTNT,

Thank you very much, I have tested the solution you provided, It is working. Thanks again.

Toshi_Esumi

SuperUser

Is this a typo? The second one is a different address object named "Terminal_192.0.132.1", with the same subnet (IP). They can coexist though.

In any case, no reboot is required for any address object changes. You should be able to remove the interface association by "unset associated-interface" under the original address object editting mode. You might need to take it out of policies if it's already used with other objects. After 6.2, you can't mix those objects with specific interface assiation and others without it on the same policy.

Toshi

yktee99Author

New Member

Toshi,

Thank you very much for your reply.

Spot on, yes, it is a typo.

I have multiple "set associated-interface "xxx" commands in my config but I only need to remove one, will the "unset associated-interface" command remove all of them? As I only need to remove only one, can I use unset associated-interface "Terminal10" to remove this specify one instead? Thanks.