Zones: Missing Interface

[ChriDean]

I am trying to start using zones but when I create an OUTSIDE zone and look for my WAN interface its NOT in the list.

Why would my WAN physical interface be missing from the list and how do I fix this?

Also do you guys use Zones?

Thank you.

[ShanWill]

If the interface is currently part of a firewall policy it won't let you add it to a zone. You basically need to just remove it from the policy then add to the zone then add the zone to the policy

[ShanWill]

Zones can significantly simplify things

[lbjust]

As Shade said, probably your interface is already in use, so you will not be able to add it into a zone while it is being referenced.

Here we have something that may help you: https://kb.fortinet.com/kb/documentLink.do?externalID=FD41560

[peter_wild]

Do I understand this right:
If I add two similar interfaces A and B to zone Z, 
- I can use zone Z in a policy which should apply to both interfaces A and B,
- BUT I can NOT use interface A (or B) anymore in any policy if this policy should apply only to a single interface???

I don't understand the reason for this strict restriction.

[ShanWill]

Yes that is correct and completely understand the frustration with that in particular ( been down that road before ). This is one thing I am hoping to see changed in future FortiOS  versions giving a little more flexibility in interface / zone usage in policies.

[nradia_FTNT]

Similarly if there is any Aggregate interface and if it has a VLAN underneath with references, you will need to delete all the references first before you can add that VLAN to a zone.

Delete will be grayed out until references are removed.

If you cannot delete from GUI, you also have option to edit the config file in notepad (delete references from config file), and then restore it back to the firewall. FortiGate will perform a reboot upon restore of the config file so it should be done in the maintenance period or off-peak hours.