Stackvora.tech

Authorize a FortiSwitch via FortiLink

FortiLink is Fortinet's proprietary protocol that enables FortiGate firewalls to manage FortiSwitch Ethernet switches. This integration simplifies network…

FortiLink is Fortinet's proprietary protocol that enables FortiGate firewalls to manage FortiSwitch Ethernet switches. This integration simplifies network administration by centralizing switch configuration, monitoring, and troubleshooting directly from the FortiGate's web UI or CLI. This article details the process of authorizing a new FortiSwitch via FortiLink, covering typical deployment scenarios and configuration specifics.

The FortiLink connection can be established over a dedicated physical interface, a hardware or software switch, or a Link Aggregation Group (LAG). The FortiGate acts as the FortiLink controller, providing DHCP, NTP, and DNS services to the connected FortiSwitch units and pushing configuration for VLANs, port settings, and security policies.

Pre-requisites and Initial Setup

Before connecting a FortiSwitch, ensure your FortiGate is running a compatible FortiOS version (e.g., FortiOS 6.2.x or later for advanced features). The FortiSwitch OS should also be compatible; often, FortiGate will automatically upgrade the FortiSwitch firmware if a newer version is available and configured on the FortiGate.

FortiGate FortiLink Interface Configuration

Identify an unused physical interface or an aggregated interface on your FortiGate to dedicate as the FortiLink port. For redundancy and higher bandwidth, consider using a Link Aggregation Group (LAG) for FortiLink. Here’s a basic configuration example for a single physical interface (e.g., port4) or a LAG named "fortilink-lag":

config system interface
    edit "port4"
        set ip 169.254.1.1 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm
        set fortilink enable
        set secondary-ip enable
        config secondaryip
            edit 0
                set ip 169.254.2.1 255.255.255.0
                set allowaccess ping https ssh http telnet fgfm
            next
        end
    next
end

# For a LAG interface (assuming port5 and port6 are physical members)
config system interface
    edit "fortilink-lag"
        set vdom "root"
        set type aggregate
        set member "port5" "port6"
        set ip 169.254.1.1 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm
        set fortilink enable
        set secondary-ip enable
        config secondaryip
            edit 0
                set ip 169.254.2.1 255.255.255.0
                set allowaccess ping https ssh http telnet fgfm
            next
        end
    next
end

The set ip 169.254.1.1 255.255.255.0 command configures the FortiLink management subnet. The secondary IP is optional but recommended for scenarios where multiple FortiSwitch units are connected or for specific HA deployments. The set allowaccess line ensures the FortiGate can manage the FortiSwitch.

FortiSwitch Initial State

A new FortiSwitch (factory default) will attempt to obtain an IP address via DHCP. When connected to a FortiLink-enabled FortiGate port, the FortiSwitch will receive an IP from the FortiGate's internal DHCP server (e.g., 169.254.1.2/24 in the above example). It will then discover the FortiGate FortiLink controller and become visible for authorization.

Connecting and Authorizing the FortiSwitch

Physically connect the FortiSwitch uplink port(s) to the designated FortiLink port(s) on the FortiGate. For single connections, any standard Ethernet port on the FortiSwitch can typically be used as an uplink, but consult the FortiSwitch model's documentation for specific recommendations (e.g., dedicated uplink ports on certain models). For LAGs, connect the respective physical ports on the FortiSwitch to the FortiGate's LAG member ports.

GUI Authorization

Once connected, navigate to the FortiGate's web UI:

  1. Go to WiFi & Switch Controller > Managed FortiSwitch.
  2. Look for the Pending Authorization section. Your newly connected FortiSwitch should appear here with its serial number and model.
  3. Select the FortiSwitch and click Authorize.
  4. A prompt will appear asking you to confirm the authorization. Click OK.

After authorization, the FortiGate will push its configuration (VLANs, global settings) to the FortiSwitch. The FortiSwitch's status will change from "Pending Authorization" to "Managed." This process might take a few minutes, during which the FortiSwitch may reboot or experience temporary connectivity loss as it updates its firmware and applies the FortiGate's configuration.

CLI Authorization

Authorization can also be performed via the FortiGate CLI. First, identify the serial number of the pending FortiSwitch:

diagnose switch-controller switch-info list

This command will display a list of all detected FortiSwitch units, including those pending authorization. Look for entries with "State: Pending Authorization".

Once you have the serial number (e.g., "FS108E4Q1800XXXX"), authorize it:

config switch-controller managed-switch
    edit FS108E4Q1800XXXX
        set status authorize
    end

After executing this command, the FortiGate will begin the authorization and configuration push process.

Post-Authorization Configuration

Once authorized, the FortiSwitch becomes an integral part of the FortiGate's managed network. All further configurations, such as VLANs, port assignments, storm control, and PoE settings, are performed on the FortiGate and pushed down to the FortiSwitch.

Creating VLANs and Assigning to FortiSwitch Ports

Network segmentation with VLANs is a fundamental aspect of secure network design. FortiLink simplifies this by allowing VLAN definition on the FortiGate and then assigning them to FortiSwitch ports.

  1. On the FortiGate, go to WiFi & Switch Controller > FortiSwitch VLANs.
  2. Click Create New to define your desired VLANs (e.g., VLAN 10 for Staff, VLAN 20 for Guests). Specify VLAN ID, name, and IP subnet if it's a routed VLAN interface.
  3. Then, navigate to WiFi & Switch Controller > Managed FortiSwitch.
  4. Select the authorized FortiSwitch and click Edit.
  5. Under the Ports tab, you can configure each individual port. For a client access port, set the Native VLAN to the desired client VLAN (e.g., VLAN 10) and ensure Allowed VLANs includes only that VLAN or "All" for trunk ports connecting to other network devices.
  6. For uplink ports (if connecting to another switch or device), configure them as trunk ports by setting a PVID (Port VLAN ID) and allowing multiple VLANs.
# CLI example: Create a VLAN and assign to a FortiSwitch port
# 1. Create a FortiSwitch VLAN (logical interface on FortiGate)
config system interface
    edit "vlan10_staff"
        set vdom "root"
        set ip 10.0.10.1 255.255.255.0
        set interface "fortilink" # Or "fortilink-lag"
        set vlanid 10
        set allowaccess ping https ssh http
        set role lan
    next
end

# 2. Configure a specific FortiSwitch port (e.g., port 1 on FS108E4Q1800XXXX)
config switch-controller managed-switch
    edit FS108E4Q1800XXXX
        config ports
            edit "port1"
                set switch-id FS108E4Q1800XXXX # Usually auto-populated
                set type physical
                set fortilink-port disable
                set vlan "vlan10_staff" # Sets native VLAN
                # To allow multiple VLANs (trunk port)
                # set trunk enable
                # set allowed-vlans "vlan10_staff" "vlan20_guest"
                # set native-vlan "vlan10_staff"
            next
        end
    next
end

After configuration, connect client devices to the FortiSwitch ports. They will receive IP addresses from the FortiGate's DHCP server for the assigned VLAN and operate under the FortiGate's security policies.

FortiLink Modes and High Availability

FortiLink can operate in different modes, primarily depending on the FortiGate's deployment and scale.

  • Dedicated Interface: A single physical interface or LAG on the FortiGate dedicated solely to FortiLink. Recommended for simplicity and performance.
  • Hardware/Software Switch: The FortiLink interface can be part of a FortiGate hardware or software switch, allowing other non-FortiLink devices or interfaces to share the same logical segment. While flexible, this adds complexity and can affect performance if not properly designed.

For high availability (HA) FortiGate clusters, FortiLink setup requires careful consideration:

  • Active-Passive HA: The FortiLink interface is typically configured on both HA members. The active FortiGate manages the FortiSwitch, and in a failover, the passive FortiGate takes over management seamlessly. The FortiSwitches recognize the new active controller.
  • Active-Active HA: FortiLink in Active-Active HA is more complex and typically not recommended for direct FortiLink interface setup. Instead, consider using multiple FortiLink interfaces or specific designs to manage different sets of FortiSwitches, or leverage FortiGate's Virtual Domains (VDOMs) for logical separation.

Confirm the FortiLink monitoring settings for HA by navigating to WiFi & Switch Controller > FortiLink Interface > Edit > FortiLink Monitoring. This ensures the FortiGate monitors the FortiSwitch connection and can trigger HA failover if the link goes down.

Troubleshooting Common Pitfalls

  • FortiSwitch not appearing in "Pending Authorization":
    • Physical connection: Double-check the cable between the FortiGate and FortiSwitch. Ensure the FortiSwitch is powered on.
    • FortiLink Enablement: Verify the FortiGate interface has set fortilink enable.
    • IP Conflict/DHCP issues: Check FortiGate's DHCP server on the FortiLink interface. The FortiSwitch needs an IP. Use diagnose dhcp server leases <interface> on FortiGate.
    • Firmware incompatibility: Although rare with modern FortiOS, significantly older or newer FortiSwitch firmware might prevent discovery. Check Fortinet's compatibility matrix.
    • Factory Reset: If the FortiSwitch was previously managed by another FortiGate or has custom configuration, perform a factory reset on the FortiSwitch (e.g., execute factoryreset on FortiSwitch CLI or hold reset button).
  • Authorization fails or FortiSwitch goes "Offline":
    • FortiLink Monitoring: If configured, this might cause issues if not correctly set up for HA.
    • Configuration Push Errors: Check FortiGate logs (Log & Report > FortiSwitch Events) for any errors during configuration deployment.
    • FortiSwitch Power Cycle: Sometimes a simple power cycle of the FortiSwitch can resolve a stuck state.
  • VLANs not working on FortiSwitch ports:
    • VLAN Definition: Ensure the VLANs are correctly defined on the FortiGate under WiFi & Switch Controller > FortiSwitch VLANs and have the correct VLAN ID.
    • Port Assignment: Verify the FortiSwitch port's native VLAN and allowed VLANs are correctly set from the FortiGate UI.
    • FortiGate Firewall Policies: Remember to create appropriate firewall policies on the FortiGate for inter-VLAN routing (e.g., between vlan10_staff and vlan20_guest) if routing is desired.

Back to the knowledge base · Ask the AI assistant