Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

ChriDean
New Contributor

Zones: Missing Interface

I am trying to start using zones but when I create an OUTSIDE zone and look for my WAN interface its NOT in the list.

Why would my WAN physical interface be missing from the list and how do I fix this?

Also do you guys use Zones?

Thank you.
6 REPLIES 6
ShanWill
New Contributor III

If the interface is currently part of a firewall policy it won't let you add it to a zone. You basically need to just remove it from the policy then add to the zone then add the zone to the policy
ShanWill
New Contributor III

Zones can significantly simplify things
lbjust
New Contributor II

As Shade said, probably your interface is already in use, so you will not be able to add it into a zone while it is being referenced.

Here we have something that may help you: https://kb.fortinet.com/kb/documentLink.do?externalID=FD41560
peter_wild

Do I understand this right:
If I add two similar interfaces A and B to zone Z, 
- I can use zone Z in a policy which should apply to both interfaces A and B,
- BUT I can NOT use interface A (or B) anymore in any policy if this policy should apply only to a single interface???

I don't understand the reason for this strict restriction.
ShanWill
New Contributor III

Yes that is correct and completely understand the frustration with that in particular ( been down that road before ). This is one thing I am hoping to see changed in future FortiOS  versions giving a little more flexibility in interface / zone usage in policies.



nradia_FTNT

Similarly if there is any Aggregate interface and if it has a VLAN underneath with references, you will need to delete all the references first before you can add that VLAN to a zone.

 

Delete will be grayed out until references are removed.

 

If you cannot delete from GUI, you also have option to edit the config file in notepad (delete references from config file), and then restore it back to the firewall. FortiGate will perform a reboot upon restore of the config file so it should be done in the maintenance period or off-peak hours.