Rename an IPsec Phase 2

[IrbkOrrum]

When I used the FortiConverter to convert my ASA config into FortiGate, I really didn't care about the Phase2 VPN names. Now the migration to the FortiGate is done and I find that I would like to rename the Phase2 interfaces.  Is this possible after the fact?  I know it's not possible in the GUI, but thought it might be via CLI however I wasn't able to figure it out just poking at the CLI.

[Toshi_Esumi · Accepted solution]

There is no such thing as "Phase2 interface". Only Phase1(phase1-interface) becomes its interface name.
I would just copy the content of phase2-interface config in CLI, then delete the current phase2-interface config then paste the saved config after changing the phase2-interface name. The name is not referred at any other part of config. So it shouldn't cause any error. The tunnel of course goes down once but should come back up if traffic exists.

Toshi

[IrbkOrrum]

Yeah, I thought about doing exactly that, but then there is the risk of the VPN not coming back up for whatever stupid reason.  So it's a little bit of an "if it's not broke, don't fix it".  It just would be sort of nice to see that the Phase2 "Mirth_Test" interface is up rather than just seeing "MetropolisIndia_1" is up.  I'm sure eventually I'll remember that "MetropolisIndia_1" = "Mirth_Test" but when you've got 24 VPNs each with at least 2 Phase 2's, it's going to be a bit before I remember them all.  It's not a big deal if it's not possible, it just would have been nice if it was possible.  Thanks.