Technical Tip: How to remove system interface reference (firewall sniffer) post firmware upgrade

btey · ‎07-09-2023

Description

This article describes how to remove the usage of a firewall sniffer for the system interface post-firmware upgrade to version 7.2/7.4.

Scope

FortiGate v7.2, 7.4.

Solution

Before version 7.2, the packet capture GUI interface was as below:

Post firmware upgrade to version 7.2, the system interface will show the usage of the firewall sniffer and unable to delete from GUI:

Note:
To check the reference of the interface using CLI, execute the following command 'diagnose sys cmdb refcnt show system.interface.name wan1'.

Packet capture GUI interface post version 7.2:

To remove the sniffer reference via CLI:

If the above commands failed, the VDOM is most likely configured on the FortiGate:

end

config vdom

edit ? <- Display VDOM name.

edit <vdom name> <- Case sensitive.

config firewall sniffer

show

delete <entry name>

end

Related document:

Embed real-time packet capture and analysis tool on Diagnostics page.