Unable to remove NAT from Virtual IPs

[moraa2]

I have some NAT entries I would like to get rid of, as they are no longer necessary. When I go to Policy & Objects, > Virtual IPs they are entered in there. I can create a new entry from here, but I cannot delete a current entry.

My assumption is that it is now a referenced object in a policy, if I go to Policy > Objects > Firewall Policy, I see these destination addresses (the NATs) but under the NAT column, it actually says "Disabled" and now I am even more confused.

On FG 7.0.12 ..I am new to this system. Would appreciate some help on cleaning up these entries.

[srajeswaran]

Can you share a screenshot of the policy to understand it better. Generally you need to remove the referenced NAT object from policy (even if it is disabled) and then delete the entry from NAT objects/section.

[kcheng]

Hi @moraa2 

You will need to remove the reference of the object before you can delete the VIP. The firewall policy still reference the VIP object even though it is in disabled mode. Hence, you can either replace the destination with another object, or delete the firewall policy if it's no longer required. You can refer to the article below:

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-Check-Referenced-Objects/ta-p/1948...

You can delete the VIP once the reference is showing as 0.

[mle2802]

Hi there,
You may need to remove reference before delete the item. You can check this by adding a ref column and delete all the relevant ref. Please refer to this KBs for more detail:

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-Check-Referenced-Objects/ta-p/1948...