Technical Tip: Changing VLAN interface configuration

aahmadbasri · ‎01-29-2023

Description

This article describes how to change VLAN interface configuration.

Scope

FortiGate.

Solution

Once a VLAN interface is configured, no configuration changes can be made to the VLAN ID, VLAN protocol, or physical interface.

When making these changes via the CLI, the following error will be shown :

However, another option to modify the configuration is to change it from the config file and reupload it into the device.

Note that this will cause a reboot of the device.

In this example, the physical interface of a VLAN will be changed to another physical interface.

Initial configuration of the interface :

show system interface TestVLAN

config system interface

edit "TestVLAN"

set vdom "root"

set ip 192.168.10.1 255.255.255.0

set alias "vlan10"

set device-identification enable

set role lan

set snmp-index 19

set interface "port3"

set vlanid 10

References to the VLAN interface:

To change the physical interface of this VLAN, take the following steps:

Take a backup configuration of the device.
In the config file, change the respective physical configuration of the VLAN as below:

edit "TestVLAN"

set vdom "root"

set ip 192.168.10.1 255.255.255.0

set alias "vlan10"

set device-identification enable

set role lan

set snmp-index 19

set interface "port3" <- Change to a new interface. For example, set interface 'port4'.

set vlanid 10

Save the file to a new file name.
Restore the configuration with the new config file from step 3. Note that the device will reboot.
Once the device is up, verify if there is any missing configuration from the uploaded file:

diagnose debug config-error-log read

Verify that the VLAN is now in the new physical interface:

show system interface TestVLAN

config system interface

edit "TestVLAN"

set vdom "root"

set ip 192.168.10.1 255.255.255.0

set alias "vlan10"

set device-identification enable

set role lan

set snmp-index 19

set interface "port4"

set vlanid 10

Verify that the previous reference is still in place:

Other changes in VLAN configuration can also be made using this method.

Note:

If a new interface (for example an Aggregate interface) was created to which the VLANs will be mapped, ensure that in the configuration file is restored. This new interface is placed before any of the VLAN interface configurations. Otherwise, when the configuration will be restored, the Firewall will fail to set the interface for the VLANs and they will not be created.

Also, all referenced configurations will not be created either, for example, firewall policies referencing the VLANs, etc.

Related article:

Technical Tip: Transfer/Migrate VLAN to another interface (existing or new).