Troubleshooting Tip: Error '-9999' when changing remote gateway type of an IPsec tunnel

[hbac]

Description	This article describes how to fix Error '-9999: -9999', which appears when trying to change the Remote Gateway type of an IPsec tunnel on the GUI or CLI. In this example, an attempt was made to change the Remote Gateway from static to Dynamic DNS under an IPsec tunnel 'SiteA'.
Scope	FortiGate v7.2.0 and later.
Solution	This is an expected behavior in v7.2.0 and later. The IPsec phase 1 interface type cannot be changed after it is configured. This is due to the tunnel ID parameter (tun_id), which is used to match routes to IPsec tunnels to forward traffic. If the IPsec phase 1 interface type needs to be changed, a new interface must be configured. Here is a related article on how to reconfigure the IPSEC and change the tunnel type: Technical Tip: Unable to change IPSEC tunnel type and getting -9999: -9999 error Note: This is only applicable to Route-based IPsec VPN. Changing of the remote gateway is still possible with a Policy-based IPsec VPN. Refer below to learn more about the difference between the two. Related document: VPN security policies