topic Re: Change PEER VPN in Interoperable Device in Firewall and Security Management

Change PEER VPN in Interoperable Device

aMatthew — Tue, 21 Nov 2023 14:21:58 GMT

Hi, everyone,
I would need to know a piece of information.
A provider of ours has changed the IP address of his firewall with which we have a S2S VPN. is it possible to change the VPN we already have configured by going to insert the new peer instead of the old one?
In a nutshell, if I open the interoperable object can I change the new IP address without anything being affected ?
Are there any other actions to follow?
I need to reset a new PSK

Thanks to all for the support.

Re: Change PEER VPN in Interoperable Device

G_W_Albrecht — Tue, 21 Nov 2023 15:03:00 GMT

Yes, should be easy.

Re: Change PEER VPN in Interoperable Device

the_rock — Tue, 21 Nov 2023 19:49:17 GMT

Yea, that should be pretty simple. Just make sure nothing else changed and PSK is done below (though Im sure you know that already ) : - )

Andy

Re: Change PEER VPN in Interoperable Device

aMatthew — Tue, 21 Nov 2023 20:01:42 GMT

Thanks for the support, but I need change remote peer address on star community and not the PSK.
Changing the remote IP address does not create impacts right?
Sorry for asking all these questions, but in the next few days I have to do this activity that impacts production and I am very concerned 🥶

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 09:21:36 GMT

After changing, and clicking OK I got message:

What am I misssing?

Re: Change PEER VPN in Interoperable Device

Nüüül — Wed, 16 Apr 2025 10:02:23 GMT

Had something similar in my lab, but more often and wrote a nagios check, which then updates the device.

(https://github.com/leinadred/CP_updatedynip_gw)

Line which should be interesting for you might be:

str_set_newip = "echo -e 'modify network_objects "+args.hostobjectname+" ipaddr "+str(resp_dnsip)+"\n-q\n' | dbedit -local"

So when changing IP of interoperable device named "test" to 1.2.3.7 it would look like:

[Expert@fwm:0]# dbedit -local Please enter a command, -h for help or -q to quit: dbedit> modify network_objects test ipaddr 1.2.3.7 dbedit> quit -update_all network_objects::test Updated Successfully [Expert@fwm:0]#

Changing the remote IP address does not create impacts right?

- it will, at least for a short period (sometimes it takes longer or needs a manual session deletion on both sites), until VPN is reestablished with the new IP. Thats what maintenance windows are made for 🙂

Disclaimer:

- I used this some time ago, so before doing this in production, test it. I know, it´s not pretty 😄

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 10:09:34 GMT

Is there any kb for this. I am not sure to test and play with this in prodiction time and equipment.
Why is this so complicated?

Re: Change PEER VPN in Interoperable Device

Nüüül — Wed, 16 Apr 2025 10:14:29 GMT

question - why do you not just change peer ip on interoperable device object in SmartConsole? After doing this, you will have to install policy to apply the settings to the gateway(s)

(until policy has been installed to device, the gateways are using their current settings)

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 10:18:30 GMT

I am trying to to exacly that.

networok object -> interoperable device

right click on that interoperable device ->edit

change Name to new store Name
change IPv4 to new IPv4 address.
click OK

and then, that abowe error apear...

Re: Change PEER VPN in Interoperable Device

the_rock — Wed, 16 Apr 2025 10:55:36 GMT

Hey @freeman91 , maybe I missed it, but what is the error that appears?

Andy

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 10:58:24 GMT

I just changed IP address to new one and name of the store.

R81.10 gw

R81.20 mgm server

Re: Change PEER VPN in Interoperable Device

the_rock — Wed, 16 Apr 2025 11:00:06 GMT

Never had that issue myself...maybe try deleting it and creating new one?

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 11:04:46 GMT

a bit stupid question. I need just to create new interoperable device and assign it in existing VPN Community like old one?

Re: Change PEER VPN in Interoperable Device

the_rock — Wed, 16 Apr 2025 11:06:39 GMT

Yes, BUT...to be 100% sure there wont be any conflicts, personally, I would try delete one with the issue from guidbedit first, install policy and to that.

Andy

Re: Change PEER VPN in Interoperable Device

Nüüül — Wed, 16 Apr 2025 11:06:50 GMT

when you have the pre shared key - another way to do this.

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 12:03:12 GMT

I tried with other interoperable device, and this time I just changed one letter in the name, and result is the same. Can this be some bug or something?

Re: Change PEER VPN in Interoperable Device

the_rock — Wed, 16 Apr 2025 12:09:10 GMT

I dont think so, I did that so many times, never had an issue. I really cant say why you keep getting that, would need to see it for myself.

Andy

Re: Change PEER VPN in Interoperable Device

the_rock — Wed, 16 Apr 2025 12:24:45 GMT

If you are allowed to do remote, I have 30 mins before I start my day, so we can definitely check, let me know.

Andy

Re: Change PEER VPN in Interoperable Device

freeman91 — Wed, 16 Apr 2025 12:30:25 GMT

Thank you for your willingness. It is not up to me to this time.

I am kind of people that will search over the internet, twice, before let someone to do a job insted of me.

Re: Change PEER VPN in Interoperable Device

the_rock — Wed, 16 Apr 2025 12:33:13 GMT

Dont look at it like that, my motto is we should all work as a team to help one another, thats it.

Anyway, lets just recap briefly:

1) you get same error with new interoperable object?

2) Did you try delete forst one via guidbedit and install policy?

3) if yes to 2, does same issue remain?

4) If no to 2, any different warning?

Andy