Remove Interface from switch mode

[CorneJvV]

Hello All

When I setup a FortiGate, the first thing I do is remove the interfaces from Switch Mode.

We recently took over a new client and their FG is still in switch mode.

They now require an new network segment to be added and all of the other interfaces are in use. (WAN1, WAN2 and DMZ)

Is there a way to remove one Interface from switch port mode (1-14) ?

Model: FG100D

FortiOS: 5.0

[gschmitt]

First go to Network > Interfaces

If not already present right click the little top bar with "Status" "Name" etc. and make sure Ref. is enabled.

You need to remove all policies, objects, etc. refering to the internal interface, Ref. needs to be at 0. If you click on the little number it shows you what is still referencing it. Remove all of it.

Once Ref. is 0 just right click the internal interface and select Change Mode

Yes, this will cause some downtime.

[CorneJvV]

gschmitt wrote:

First go to Network > Interfaces

If not already present right click the little top bar with "Status" "Name" etc. and make sure Ref. is enabled.

You need to remove all policies, objects, etc. refering to the internal interface, Ref. needs to be at 0. If you click on the little number it shows you what is still referencing it. Remove all of it.

Once Ref. is 0 just right click the internal interface and select Change Mode

Yes, this will cause some downtime.

Thank you gschmitt.

I was afraid of this. Having to remove all policies and references to change from switch mode to stand alone interfaces.

I was hoping there was some sort of short cut where I could just go into the CLI and just remove (Example port 10) from the Internal switch.

[gschmitt]

CorneJvV wrote:

I was hoping there was some sort of short cut where I could just go into the CLI and just remove (Example port 10) from the Internal switch.

Not that I am aware off. But honestly recreating policies is the least of your problems, document your existing policies beforehand (AND MAKE A BACKUP OF THE CONFIG!!! ;p) and recreate them.

If you encounter any weird Refs. you are unsure off just let me know.

[Johan_Witters]

If I'm not mistaken there is a possibility to take ports out of the switch... give me 5 minutes to check

[Johan_Witters]

You can check the following:

1) in the gui, you should be able to edit the switch interface and remove the ports you don't want to be in the switch

2) in cli type the following:

- config system interface

- get

- search your switch interface

- edit <interface name>check the switch type:  (set type hard-switch)

Next, check the hard-switch:

- config system virtual-switch

- edit <interface-name>

- show

should give you something like:

config system virtual-switch     edit "lan"         set physical-switch "sw0"             config port                 edit "port15"                 next                 edit "port16"                 next             end     next end

change the config to include/exclude the ports needed..

*************

EDIT

*************

If this doesn't work, I suggest the following:

1) take 2 backups of the current configuration

2) store 1 backup on a separate location

3) Change the 2nd backup: reconfigure the ports and alter policies, objects, DHCP etc to match the new configuration

4) delete all referring objects: policies, DHCP-servers, routes, policy routes, address objects etc. If you have a lot of object you could just purge the complete list of entries, and paste all params back afterwards

5) change the switch mode:

- config system global

- set internal-switch-mode interface

- end

6) the unit will reboot

7) in cli, paste back the changed configuration entries.

If anything should not be clear, I'll be glad to help you further

[CorneJvV]

wittersjohan wrote:

You can check the following:

1) in the gui, you should be able to edit the switch interface and remove the ports you don't want to be in the switch

2) in cli type the following:

- config system interface

- get

- search your switch interface

- edit <interface name>check the switch type:  (set type hard-switch)

Next, check the hard-switch:

- config system virtual-switch

- edit <interface-name>

- show

should give you something like:

config system virtual-switch    edit "lan"        set physical-switch "sw0"            config port                edit "port15"                next                edit "port16"                next            end    next end

change the config to include/exclude the ports needed..

Thank you so much Johan and everyone that contributed.

Will try this and report back.

[gschmitt]

CorneJvV wrote:

wittersjohan wrote:

You can check the following:

1) in the gui, you should be able to edit the switch interface and remove the ports you don't want to be in the switch

2) in cli type the following:

- config system interface

- get

- search your switch interface

- edit <interface name>check the switch type:  (set type hard-switch)

Next, check the hard-switch:

- config system virtual-switch

- edit <interface-name>

- show

should give you something like:

config system virtual-switch   edit "lan"       set physical-switch "sw0"           config port               edit "port15"               next               edit "port16"               next           end   next end

change the config to include/exclude the ports needed..

Thank you so much Johan and everyone that contributed.

Will try this and report back.

Please do, I just tried this methode on a 60C and it didn't work

I assume wittersjohans device already is in interface mode :\

[Johan_Witters]

gschmitt wrote:

Please do, I just tried this methode on a 60C and it didn't work

I assume wittersjohans device already is in interface mode :\

This actually is FGT100D config, as far as I recall it was not put in interface mode, but just ports taken out of the switch as described keeping only ports 15-16 in switch mode.

But you are correct in that it does not work on a 60C, unless changed in recent FOS, you can't remove ports from the "switch" interface. For that type of unit you have to change the unit to interface mode. If afterwards you need some ports in switch mode, you need to configure a software switch.

[rok]

Hello Guys

I have a Fortigate 90D POE version 5.2.7 , i would like to change the switch mode to interface .

see command used:

after disabling dhcp server and deleted all policies objects , i type this command :

config system global

set internal-switch-mode interface

end

it does not ask to reboot and command doesn't work too.

Help Guys