diff --git a/doc/ChangeLog b/doc/ChangeLog
index e2b061833..eb2a9a7d8 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,13 @@
+2011-05-17  vadim  <vadim@netcitadel.com>
+
+	* FWObjectDatabase_tree_ops.cpp (merge): see #2420 "Crash when
+	selecting New Firewall and existing firewall has interface that is
+	locked". Fixed GUI crash that happened on some operations if an
+	object in the tree was locked. For example, if the user locked an
+	interface of one of the firewall objects that then proceeded to
+	create new firewall object, the GUI would crash. The problem was
+	not limited to locking specifically interface objects.
+
 2011-05-15  vadim  <vadim@netcitadel.com>
 
 	* IPTImporter.cpp (pushPolicyRule): see #2411 Implemented import
diff --git a/src/libfwbuilder/src/fwbuilder/FWObject.cpp b/src/libfwbuilder/src/fwbuilder/FWObject.cpp
index 6f1081482..d7487ca8e 100644
--- a/src/libfwbuilder/src/fwbuilder/FWObject.cpp
+++ b/src/libfwbuilder/src/fwbuilder/FWObject.cpp
@@ -1346,8 +1346,8 @@ bool FWObject::isReadOnly()
 
 void FWObject::checkReadOnly() throw(FWException)
 {
-    if (isReadOnly()) throw FWException(
-        string("Attempt to modify read-only object ")+getName());
+    if (isReadOnly() && ! getRoot()->getIgnoreReadOnlyFlag())
+        throw FWException(string("Attempt to modify read-only object ")+getName());
 }
 
 FWObjectTypedChildIterator::FWObjectTypedChildIterator(
diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp
index 94ce9a865..048d8c107 100644
--- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp
+++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp
@@ -123,6 +123,7 @@ FWObjectDatabase::FWObjectDatabase() : FWObject(false), data_file(), obj_index()
     index_hits = index_misses = 0;
     init_id_dict();
     predictable_id_tracker = 0;
+    ignore_read_only = false;
 
     searchId =0;
     lastModified = 0;
@@ -142,6 +143,7 @@ FWObjectDatabase::FWObjectDatabase(FWObjectDatabase& d) :
     index_hits = index_misses = 0;
     init_id_dict();
     predictable_id_tracker = 0;
+    ignore_read_only = false;
 
     data_file = d.data_file;
 
diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h
index ed630aa3e..c497e725d 100644
--- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h
+++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h
@@ -251,7 +251,8 @@ protected:
         std::map<int, FWObject*> obj_index;
         int searchId;
         int predictable_id_tracker;
-
+        bool ignore_read_only;
+        
         void init_create_methods_table();
         void init_id_dict();
 
@@ -332,6 +333,13 @@ public:
          */
         void getIndexStats(int &index_size, int &hit_counter, int &miss_counter);
 
+        /**
+         * Some operations, such as object tree merging, should ignore
+         * read-only flag on individual objects.
+         */
+        bool getIgnoreReadOnlyFlag() { return ignore_read_only; }
+        void setIgnoreReadOnlyFlag(bool f) { ignore_read_only = f; }
+
         // --- XML import/export ---
     
         virtual void fromXML(xmlNodePtr xml_parent_node) throw(FWException);
@@ -380,7 +388,15 @@ public:
         void findObjectsInGroup(
             libfwbuilder::Group *g,
             std::set<libfwbuilder::FWObject *> &resset);
-    
+
+        /**
+         * We ignore read-only flag on individual objects when whole object
+         * tree is duplicated
+         */
+        virtual FWObject& duplicate(const FWObject *obj,
+                                    bool preserve_id = true) throw(FWException);
+
+        
         void recursivelyRemoveObjFromTree(FWObject* obj, bool remove_ref=false);
 
         /**
@@ -400,7 +416,6 @@ public:
          * This means returned object can be a parent for the copy of <source>.
          */
         FWObject* reproduceRelativePath(FWObject *lib, const FWObject *source);
-
     
         /**
          * fix references in children of obj according to the map_ids which
diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp
index 3eaa7ff17..04b3a23db 100644
--- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp
+++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp
@@ -479,10 +479,12 @@ void FWObjectDatabase::merge( FWObjectDatabase *ndb,
                               ConflictResolutionPredicate *crp)
 {
     busy = true;
+    setIgnoreReadOnlyFlag(true);
 
     FWObjectTreeScanner scanner(this, crp);
     scanner.merge(NULL, ndb);
 
+    setIgnoreReadOnlyFlag(false);
     busy = false;
 }
 
@@ -701,3 +703,11 @@ FWObject* FWObjectDatabase::reproduceRelativePath(FWObject *lib,
     return target;
 }
 
+FWObject& FWObjectDatabase::duplicate(const FWObject *obj,
+                                      bool preserve_id) throw(FWException)
+{
+    setIgnoreReadOnlyFlag(true);
+    FWObject::duplicate(obj, preserve_id);
+    setIgnoreReadOnlyFlag(false);
+}
+