Change the interface names Fortigate 60c

[jrothwell1988]

I am looking to change the interface names on my 60c v4.0,build0646,121119 (MR3 Patch 11).

Thanks

[emnoc]

all of what is said  is true keep in mind zones are good for the right reason.

The question that you should ask yourself

Now why do you think you need to  rename a interface? 

What's  to be gained ?

Can you live with a ZBFW ?

Once you go zone it hard to go back and if you ever ever ever want to place just one policy for that interface that's in a zone, it CAN NOT BE DONE !

YMMV

Ken

[tanr]

True, if I have multiple interfaces in a zone I won't be able to have a security policy work on just one of those interfaces.

It does seem, though, that zones make moving and modifying an interface much easier for some cases.  In the example above I can't have only one interface out of many in a zone handled by a separate security policy.  However, I can create another zone (slippery slope!), set up security policies and references as needed, then easily move that interface from the first zone into the second.

As to why I'd want to rename an interface: proper naming, good comments, and documentation all work together to help me or somebody else working on the system.  So much easier not to make a mistake!

One of the few things I miss from previous network hardware is being able to rename interfaces, zones, addresses, etc. and having it all just update and work.

[emnoc]

FWIW

I don't  think I never seen a firewall that would allow you to re-namd a defined name and outside of a cisco ASA ( which is zone based  btw  ) you can't name physical interface.  Even a virtual interface ( loop,  802.1q,   GRE , ipsec ) is almost 100% impossible to  rename.

Alias is probably what you want  imho and descriptions. These also map back into  SNP IF-MIBs.

Ken

[tanr]

You're right, I meant changing interface aliases, not names.

I could rename zones, addresses, security profiles, etc. and have them auto-magically just work with ZyXEL equipment.  I had too many other issues with them, though.

[ede_pfau]

FTNT recently (~ 1-2 yrs) started to make name changes easier; you can rename address objects on the fly, even if they are group members. In more or less all other places objects cannot be renamed (yet) which is a pity. The reason for this probably is that some changes would require a reboot, or the rename process would not only have to change objects in the config file but structures in RAM as well. A reboot then is clean and easy in comparison.

One can see that for the user the behavior would be inconsistent, i.e. sometimes a rename happens otf and sometimes the FGT would demand a reboot. Which almost always is what an admin fears.