New Member

Question

Remove Interface from switch mode

Forum|Forum|11 years ago
June 5, 2015
3 replies
59766 views

Hello All

When I setup a FortiGate, the first thing I do is remove the interfaces from Switch Mode.

We recently took over a new client and their FG is still in switch mode.

They now require an new network segment to be added and all of the other interfaces are in use. (WAN1, WAN2 and DMZ)

Is there a way to remove one Interface from switch port mode (1-14) ?

Model: FG100D

FortiOS: 5.0

gschmitt

New Member

First go to Network > Interfaces

If not already present right click the little top bar with "Status" "Name" etc. and make sure Ref. is enabled.

You need to remove all policies, objects, etc. refering to the internal interface, Ref. needs to be at 0. If you click on the little number it shows you what is still referencing it. Remove all of it.

Once Ref. is 0 just right click the internal interface and select Change Mode

Yes, this will cause some downtime.

CorneJvVAuthor

New Member

gschmitt wrote:
First go to Network > Interfaces
If not already present right click the little top bar with "Status" "Name" etc. and make sure Ref. is enabled.
You need to remove all policies, objects, etc. refering to the internal interface, Ref. needs to be at 0. If you click on the little number it shows you what is still referencing it. Remove all of it.
Once Ref. is 0 just right click the internal interface and select Change Mode

Yes, this will cause some downtime.

Thank you gschmitt.

I was afraid of this. Having to remove all policies and references to change from switch mode to stand alone interfaces.

I was hoping there was some sort of short cut where I could just go into the CLI and just remove (Example port 10) from the Internal switch.

gschmitt

New Member

CorneJvV wrote:
I was hoping there was some sort of short cut where I could just go into the CLI and just remove (Example port 10) from the Internal switch.

Not that I am aware off. But honestly recreating policies is the least of your problems, document your existing policies beforehand (AND MAKE A BACKUP OF THE CONFIG!!! ;p) and recreate them.

If you encounter any weird Refs. you are unsure off just let me know.

Johan_Witters

New Member

If I'm not mistaken there is a possibility to take ports out of the switch... give me 5 minutes to check

Johan_Witters

New Member

You can check the following:

1) in the gui, you should be able to edit the switch interface and remove the ports you don't want to be in the switch

2) in cli type the following:

- config system interface

- get

- search your switch interface

- edit <interface name>check the switch type: (set type hard-switch)

Next, check the hard-switch:

- config system virtual-switch

- edit <interface-name>

- show

should give you something like:

config system virtual-switch edit "lan" set physical-switch "sw0" config port edit "port15" next edit "port16" next end next end

change the config to include/exclude the ports needed..

*************

EDIT

*************

If this doesn't work, I suggest the following:

1) take 2 backups of the current configuration

2) store 1 backup on a separate location

3) Change the 2nd backup: reconfigure the ports and alter policies, objects, DHCP etc to match the new configuration

4) delete all referring objects: policies, DHCP-servers, routes, policy routes, address objects etc. If you have a lot of object you could just purge the complete list of entries, and paste all params back afterwards

5) change the switch mode:

- config system global

- set internal-switch-mode interface

- end

6) the unit will reboot

7) in cli, paste back the changed configuration entries.

If anything should not be clear, I'll be glad to help you further

CorneJvVAuthor

New Member

wittersjohan wrote:
You can check the following:
1) in the gui, you should be able to edit the switch interface and remove the ports you don't want to be in the switch
2) in cli type the following:
- config system interface
- get
- search your switch interface
- edit <interface name>check the switch type: (set type hard-switch)

Next, check the hard-switch:
- config system virtual-switch
- edit <interface-name>
- show
should give you something like:
config system virtual-switch edit "lan" set physical-switch "sw0" config port edit "port15" next edit "port16" next end next end
change the config to include/exclude the ports needed..

Thank you so much Johan and everyone that contributed.

Will try this and report back.

gschmitt

New Member

CorneJvV wrote:
wittersjohan wrote:
You can check the following:
1) in the gui, you should be able to edit the switch interface and remove the ports you don't want to be in the switch
2) in cli type the following:
- config system interface
- get
- search your switch interface
- edit <interface name>check the switch type: (set type hard-switch)

Next, check the hard-switch:
- config system virtual-switch
- edit <interface-name>
- show
should give you something like:
config system virtual-switch edit "lan" set physical-switch "sw0" config port edit "port15" next edit "port16" next end next end
change the config to include/exclude the ports needed..

Thank you so much Johan and everyone that contributed.
Will try this and report back.

Please do, I just tried this methode on a 60C and it didn't work

I assume wittersjohans device already is in interface mode :\

Sign up

Login with SSO

Login to the community

Login with SSO