Technical Tip: How to remove system interface reference (firewall sniffer) post firmware upgrade

[btey]

Description	This article describes how to remove the usage of a firewall sniffer for the system interface post-firmware upgrade to version 7.2/7.4.
Scope	FortiGate v7.2, 7.4.
Solution	Before version 7.2, the packet capture GUI interface was as below:   Post firmware upgrade to version 7.2, the system interface will show the usage of the firewall sniffer and unable to delete from GUI: Note: To check the reference of the interface using CLI, execute the following command 'diagnose sys cmdb refcnt show system.interface.name wan1'. Packet capture GUI interface post version 7.2:   To remove the sniffer reference via CLI: If the above commands failed, the VDOM is most likely configured on the FortiGate: end config vdom edit ?  <- Display VDOM name. edit <vdom name>  <- Case sensitive. config firewall sniffer show delete <entry name> end end Related document: Embed real-time packet capture and analysis tool on Diagnostics page.