GRE tunnel, modify remote-gateway

[evince]

Hi all,

I'm running several gre tunnels, all is working perfect. By the way i'd like to modify 1 remote-gateway. I've tried via CLI but i get an error :

unexpected to change gateway address! attribute set operator error, -61, discard the setting

Here is the config :

FGVM-ITX (gre-vince-test) # show config system gre-tunnel

edit "gre-vince-test"

set interface "port10"

set remote-gw xxx.xxx.xxx.xxx ==> IP i need to change

set local-gw zzz.zzz.zzz.zzz

next

end

Do you have any idea?

Thank you in advance,

Bests Regards,

[emnoc]

I don't think you can modify the tunnel entries after it's configured. You can edit  a save cfg file  and then do a restoral.

[norouzi]

or delete the tunnel and create it again.

[evince]

Dear all,

Thank you for your help. It's a bad new, this firewall is in production and i can not reboot it as i want. I have a lot of policies so it is impossible to delete and renew the tunnel :(

[norouzi]

In this case the best way is changing your configuration from backup and restore it as emnoc said.

[evince]

Ok thank you very much.

[emnoc]

Keep in mind  a configuration  restoral is going cause a reboot.

I think another trick would be o place the interface into a zone before you nail policies and then you add the new GRE tunnel into the same zone and delete the old one. But that would also require you to "remove" all policies in your case.

e.g

config system zone     edit "mytunnel"         set interface "tun1" "tun2"     next end

and

config system gre-tunnel     edit "tun1"         set remote-gw 199.111.111.1         set local-gw 10.10.80.1     next     edit "tun2"         set remote-gw 199.111.111.2         set local-gw 10.10.80.1     next end

But once you place these into a tunnel, you can  nail  a policy to just one tunnel, but it will allow you to add or remove tunnels if the need comes up. You don't have to 1+ interfaces in a zone, So you could place one member ( tun1 ) and then if tun1 ever needs to change, you add tun2 and delete tun1.

Either way, it's not a simple  1 2 3 , but with proper planning you can eliminate most of the hassle. And I wish Fortinet would remove this restriction and allow you to re-edit the gw ip_address

YMMV

[evince]

Hello emnoc,

Thank you for your great help. Your idea about creating a zone looks wondurful for my situation. I think i'll do that :)

As you said, Fortinet should remove this restriction, it is a non-sense.

Bests Regards,

Vincent.

[netgeek1]

I know this is an old post, but I searched everywhere and was unable to find an answer that didn't require rebooting a production device, so here is the solution (steps 12-14 are done on a FortiManager, so ignore if you don't have one): 1. SSH to device (or connect to the console). 2. Find all references to tunnel name in configuration. For this example we will use "Zscaler_LON3" for the tunnel. We are changing the remote-gw IP from 145.8.20.36 to 145.8.21.246.  FG-FW01 # sh full-configuration | grep -f Zscaler_LON3 config system interface      edit "Zscaler_LON3" <---           set vdom "root"           set distance 5           ...      next end config system gre-tunnel      edit "Zscaler_LON3" <---           set interface "wan1"           set remote-gw 145.8.20.36           set local-gw 25.125.46.4           set dscp-copying disable           set keepalive-interval 0      next end config firewall policy      edit 418           set name ''           set srcintf "port3"           set dstintf "Zscaler_LON3" <---           set srcaddr "all"           set dstaddr "ext.grp.denyall.malicious" 3. Take a full copy of ALL returned examples. 4. Create a new GRE tunnel with "-bk" at the end and garbage IPs.  config system gre-tunnel      edit "Zscaler_LON3-bk"           set interface "wan1"           set remote-gw 1.1.1.254           set local-gw 1.1.1.211           set dscp-copying disable           set keepalive-interval 0      next end    5. Modify all references from original tunnel "Zscaler_LON3" to new tunnel "Zscaler_LON3-bk"  config firewall policy      edit 418           set dstintf "Zscaler_LON3-bk"      next end config router static      edit 36           set device "Zscaler_LON3-bk"      next end config router policy      edit 4101           set output-device "Zscaler_LON3-bk"      next end config system link-monitor      edit "Zscaler_LON3_Probe"           set srcintf "Zscaler_LON3-bk"      next end    6. Do another 'sh full-configuration | grep -f <tunnel-name>' and verify the only references to the original tunnel "Zscaler_LON3" are under 'config system interface' and 'config system gre-tunnel'. 7. Delete original GRE tunnel then recreate with new IP address.  FG-FW01 (gre-tunnel) # delete Zscaler_LON3 FG-FW01 (gre-tunnel) # end FG-FW01 # conf sys gre-tunnel FG-FW01 (gre-tunnel) #      edit "Zscaler_LON3" new entry 'Zscaler_LON3' added FG-FW01 (Zscaler_LON3) #         set interface "wan1" FG-FW01 (Zscaler_LON3) #         set remote-gw 145.8.21.246 FG-FW01 (Zscaler_LON3) #         set local-gw 25.125.46.4 FG-FW01 (Zscaler_LON3) #         set dscp-copying disable FG-FW01 (Zscaler_LON3) #         set keepalive-interval 0 FG-FW01 (Zscaler_LON3) #     next FG-FW01 (gre-tunnel) # end    8. Deleting the GRE tunnel has also deleted all information from the system interface, you need to add it all back in. Make sure to set the 'set remote-ip' to the new remote-gw address "145.8.21.246".  FG-FW01 (interface) # edit Zscaler_LON3  FG-FW01 (Zscaler_LON3) # show config system interface      edit "Zscaler_LON3"           set vdom "root"           set type tunnel           set snmp-index 34           set interface "wan1"      next end FG-FW01 (Zscaler_LON3) #         set vdom "root" FG-FW01 (Zscaler_LON3) #         set distance 5 FG-FW01 (Zscaler_LON3) #         set dhcp-relay-service disable FG-FW01 (Zscaler_LON3) #         set ip 172.18.100.89 255.255.255.255 ... FG-FW01 (Zscaler_LON3) #         set status up ... FG-FW01 (Zscaler_LON3) #         set remote-ip 145.8.21.246 ... FG-FW01 (Zscaler_LON3) #     next 9. Modify all references from new tunnel "Zscaler_LON3-bk" to original tunnel "Zscaler_LON3"  config firewall policy      edit 418           set dstintf "Zscaler_LON3"      next end config router static      edit 36           set device "Zscaler_LON3"      next end config router policy      edit 4101           set output-device "Zscaler_LON3"      next end config system link-monitor      edit "Zscaler_LON3_Probe"           set srcintf "Zscaler_LON3"      next end    10. Do another 'sh full-configuration | grep -f <tunnel-name>' and verify the only references to the new tunnel "Zscaler_LON3-bk" are under 'config system interface' and 'config system gre-tunnel'. 11. Delete the new tunnel "Zscaler_LON3-bk", then do another check to make sure all references are removed. 12. Do a 'Retrieve Config' from inside Device Manager -> Configuration Revision History and save the configuration. 13. Do a 'Revision Diff' and validate your change. 14. The policy will probably show RED for out-of-sync. If so, do a policy push even though it shows no changes.