Technical Tip: Unable to disable VIP entry

[MigenaM]

Description	This article explains the reason behind not being able to disable a VIP entry when pushing the configuration change from FortiManager.
Scope	FortiGate, FortiManager.
Solution	When pushing a configuration change from FortiManager to FortiGate, especially the configuration change of a VIP entry, the following error can be seen: FortiGate (NetScaler_VIP) $ set status disable Cannot disable used VIP. The reason for this error is that this VIP entry is already being used on the configuration, specifically used on a firewall policy, as seen below: config firewall policy     edit 5         set status disable         set name "5"         set uuid 21a3efce-0382-54f0-2467-597344d287f8         set srcintf "INTER"         set dstintf "SECURED_ZONE"         set action accept         set srcaddr "all"         set dstaddr NetScaler_VIP"         set schedule "always"         set service "HTTPS" "HTTP"         set logtraffic all         set global-label "Internet_Inside"     next Even if this firewall policy is disabled, the VIP entry will still be marked as used. To mitigate the behavior, another VIP entry can be used on the configuration in the firewall policy instead, or the firewall policy should be deleted altogether. Note: To verify the VIP entry reference to see where it is being used, go to Policy & Objects > Virtual IPs and click on Ref column for each entry. Note: Disabling virtual IPs can only be done if the FortiGate is using central NAT mode. This feature was introduced in v7.0: Allow VIPs to be enabled or disabled in central NAT mode.