Real-time Ethernet systems are becoming increasingly popular for avionics and embedded applications. By regulating network traffic according to predefined configurations, these protocols enable highly deterministic communication, while still conforming to the Ethernet standard. However, the strengths of a statically configured system become weaknesses when the system requirements are changed. In the worst case, the entire network may need to be reloaded with new configurations, resulting in significant downtime. As a result, there is significant growing interest in reconfiguring real-time Ethernet networks online, without loss of connectivity. Several recent works focus on minimizing frame loss and configuration conflicts during online reconfiguration. Unfortunately, in doing so, they also sacrifice the system's ability to tolerate faulty components.In this paper, Gatekeeper, the first reconfiguration protocol for real-time Ethernet systems that minimizes downtime in both the presence and absence of faults, is described.Gatekeeper consists of two main sub-protocols: 1) a reliable distribution protocol that ensures consistent configurations are deployed on all non-faulty devices (i.e., switches and network cards), and 2) a dependable test-and-migrate reconfiguration protocol that allows the system to gain confidence that the configurations are correct as they are rolled out to an increasing number of devices. We evaluated Gatekeeper's scalability to different system sizes, its timing and communication overheads, and it's correctness in the presence of different faulty configurations. Our results show that Gatekeeper can tolerate a faulty device with as little as 3% communication overhead, and while running faster than naive non-fault-tolerant solutions in large networks.