topic Re: Delete Sub-interface in General Topics

Delete Sub-interface

MPI-AE — Sat, 21 Jan 2017 10:47:34 GMT

Hey guys,

sorry for the silly question, but I have never done this before:

I would like to delete a sub-interface.

Is there a special order I have to stick to?

Delete all policies first where the zone is involved?

Delete the zone first?

Delete the interface first?

Or does this not matter?

Re: Delete Sub-interface

TranceforLife — Sat, 21 Jan 2017 12:44:57 GMT

Hi,

l think better remove the interface from the zone and then delete the subinterface. Your zone might have more interfaces than the sub-interface.

Thx,

Myky

Re: Delete Sub-interface

MPI-AE — Sat, 21 Jan 2017 13:27:25 GMT

Hey,

ok, did this!

Now my zone has no further interface.

But when I want to delete the zone, the firewall says first I have to remove the zone from all policies (security, nat, application override etc.)

But this zone is in approximately 100 policies.

Do I have to click every policy by hand now and remove the zone?

That would be very time-consuming.

Re: Delete Sub-interface

BPry — Sat, 21 Jan 2017 16:28:05 GMT

If you are comfortable with it I would edit out the zone directly in the XML and then load the config without the zone mentioned. The zone needs to be out of all rulebase before you can actually delete it, as you would have references to a zone that doesn't exist.

Re: Delete Sub-interface

TranceforLife — Sat, 21 Jan 2017 21:38:52 GMT

Would be nice to have an option to work/modify multiple objects at one time in the GUI.

Re: Delete Sub-interface

santonic — Mon, 23 Jan 2017 08:06:35 GMT

I agree.

But in this case this wouldn't be really useful. Or it would be risky at least. Because when removing objects (zones, network objects, apps..) from security rules you have to check each rule carefully. Because if the object you are removing is the only one in that field, after removing it the value of that field would become 'any'. So you could make huge holes in your FW policy when automatically removing objects from policies.

Re: Delete Sub-interface

MPI-AE — Mon, 23 Jan 2017 08:21:28 GMT

didn't consider that yet.

But good point.

Re: Delete Sub-interface

BPry — Mon, 23 Jan 2017 15:44:03 GMT

Like @santonic said they're definitively good points in not working with the XML if you don't follow everything closely or know exactly how to incorporate what is being displayed. If this is your first time modifying the XML directly I probably wouldn't do it on something this large. No matter what you do make sure to validate the config before you attempt to commit it and don't use the force method to make it take the commit if it isn't working.