Kernaali Tools
FortiGate

FortiGate Cannot Delete an Interface or Its Address Object

Remove an automatically created interface-subnet object or an obsolete packet-capture reference using the documented correction.

If Delete is grayed out for an interface’s automatically created subnet address, turn off Create address object matching subnet on that interface. If an interface instead lists an old packet capture that is missing from the GUI after an upgrade, remove that obsolete sniffer entry in the CLI.

The interface-subnet address has a grayed-out Delete action

Open Network → Interfaces, edit the affected interface and disable Create address object matching subnet. Saving removes that automatically created address object. This GUI option is shown for interfaces with role LAN or DMZ.

Alternatively, open Policy & Objects → Addresses, find that object and delete it there. Check its actual references first; update any policy that still needs the subnet before removing the object. This case is the auto-created interface address, not permission to delete a referenced policy object.

Return to the interface’s reference list and confirm the unwanted address reference has gone.

A removed packet capture still references the interface

Fortinet documents this after upgrades from 7.0.x to 7.2.x: a capture can disappear from Network → Diagnostics while its firewall sniffer entry remains. In the affected VDOM, list those entries:

Identify the obsolete capture and its interface
config firewall sniffer
    show
end

Match the entry to the interface reference and confirm that the capture is obsolete. Replace the placeholder with that entry’s ID:

Remove only the obsolete capture definition
config firewall sniffer
    delete <obsolete-capture-id>
end

Refresh the interface’s references and retry the intended deletion or reassignment. Retain any active capture or other still-required reference.

References