Stackvora.tech

Configure VLANs and PoE on FortiSwitch via FortiGate

Managing FortiSwitch deployments integrated with FortiGate presents a streamlined approach to network segmentation and power delivery. FortiLink, the…

Managing FortiSwitch deployments integrated with FortiGate presents a streamlined approach to network segmentation and power delivery. FortiLink, the proprietary protocol linking FortiGates to FortiSwitches, centralizes configuration and monitoring, eliminating the need for direct access to individual switches for most common tasks. This article details the configuration of VLANs for network segmentation and Power over Ethernet (PoE) for device powering directly from the FortiGate GUI and CLI, focusing on practical implementation for various network roles like data, voice, and management.

The examples provided assume a FortiGate running FortiOS 7.0 or later and FortiSwitch units running FortiSwitchOS 7.0 or later, managed via FortiLink in a stack or standalone configuration. A working FortiLink connection is a prerequisite for these configurations.

Understanding FortiLink and Port Roles

FortiLink establishes a logical connection between a FortiGate and one or more FortiSwitches, presenting the switches as managed devices within the FortiGate interface. This abstraction simplifies management significantly. When configuring ports, it's crucial to understand their roles:

  • FortiLink Port: The physical port(s) on the FortiGate connected to the FortiSwitch(es). These are typically members of a FortiLink interface (e.g., "fortilink").
  • Uplink Port: On the FortiSwitch, the port(s) connected to the FortiGate's FortiLink port. These are automatically configured by FortiLink and generally shouldn't be manually altered.
  • Downlink/Access Port: The ports on the FortiSwitch connecting to end devices (clients, servers, APs, IP phones). These are the ports we'll be configuring for VLANs and PoE.
  • Trunk Port: A FortiSwitch access port configured to carry multiple VLANs, often used for connecting to another switch or a device requiring multiple VLANs (e.g., a virtualized server host).

Configuring VLANs on FortiSwitch Ports

VLANs are essential for network segmentation, security, and traffic management. FortiLink allows for defining VLANs on the FortiGate and then applying them to FortiSwitch ports. VLANs must first be defined as interfaces on the FortiGate.

1. Defining VLAN Interfaces on FortiGate

Before assigning VLANs to FortiSwitch ports, you must define them as sub-interfaces (VLAN interfaces) on the FortiGate. These interfaces will serve as the Layer 3 gateways for the respective VLANs.

config system interface
    edit "VLAN_10_DATA"
        set vdom "root"
        set ip 192.168.10.1 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm snmp http-alt https-alt capwap
        set type vlan
        set vlanid 10
        set interface "fortilink"  <-- Important: Associate with the FortiLink interface
    next
    edit "VLAN_20_VOICE"
        set vdom "root"
        set ip 192.168.20.1 255.255.255.0
        set allowaccess ping https ssh
        set type vlan
        set vlanid 20
        set interface "fortilink"
    next
    edit "VLAN_30_MGMT"
        set vdom "root"
        set ip 192.168.30.1 255.255.255.0
        set allowaccess ping https ssh
        set type vlan
        set vlanid 30
        set interface "fortilink"
    next
end

In the GUI, navigate to Network > Interfaces, click "Create New" > "Interface", select "VLAN" as the Type, choose "FortiLink" as the Physical Interface, and assign the VLAN ID.

2. Assigning VLANs to FortiSwitch Access Ports (GUI)

For ports connecting to single devices (e.g., a workstation, a printer), you'll typically assign a native (untagged) VLAN.

  1. Navigate to WiFi & Switch Controller > FortiSwitch Ports.
  2. Locate the desired FortiSwitch and the specific port (e.g., S324E-A-10-1).
  3. Click on the port to open its configuration pane.
  4. Under "Native VLAN", select the appropriate VLAN interface (e.g., VLAN_10_DATA for data, VLAN_30_MGMT for a management device). This configures the port as an access port, and any untagged traffic entering this port will be associated with the native VLAN.
  5. Click "Apply". The changes are pushed to the FortiSwitch almost immediately.
  6. Optional (Voice VLAN with LLDP-MED): If connecting an IP phone, you might also configure a "Voice VLAN". Select VLAN_20_VOICE here. Crucially, enable "LLDP-MED Network Policy" below this setting. When LLDP-MED is enabled, the FortiSwitch will advertise the voice VLAN ID to the connected IP phone, allowing the phone to tag its voice traffic with the correct VLAN (e.g., VLAN 20) and pass data traffic untagged (or with the native VLAN, e.g., VLAN 10).
  7. Use the "Port Description" field liberally. Descriptions like "PC-Room101", "IPPhone-Desk3", or "AP-Hallway" are invaluable for future troubleshooting.

3. Assigning VLANs to FortiSwitch Trunk Ports (GUI)

For ports connecting to devices that require multiple VLANs (e.g., another switch, a server hosting multiple virtual machines), you'll configure an allowed VLAN list.

  1. Navigate to WiFi & Switch Controller > FortiSwitch Ports.
  2. Select the port.
  3. Under "Native VLAN", choose the VLAN for untagged traffic (e.g., VLAN_30_MGMT for switch management traffic).
  4. Under "Allowed VLANs", select "Specify".
  5. Add the VLAN interfaces that this port should carry (e.g., VLAN_10_DATA, VLAN_20_VOICE).
  6. Click "Apply".

4. CLI Configuration for VLANs

While the GUI is intuitive, the CLI offers more control for bulk configurations or specific scenarios.

config switch-controller managed-switch
    edit <FortiSwitch_Serial_Number>
        config ports
            edit "port1"
                set description "Workstation_Room1"
                set switch-mode static
                set vlan "VLAN_10_DATA"       <-- Sets native VLAN
                set access-mode untagged
                set status enable
            next
            edit "port2"
                set description "IP_Phone_Desk"
                set switch-mode static
                set vlan "VLAN_10_DATA"       <-- Native VLAN for data
                set access-mode untagged
                set voice-vlan "VLAN_20_VOICE" <-- Voice VLAN
                set lldp-med-network-policy enable <-- Enable LLDP-MED
                set status enable
            next
            edit "port3"
                set description "Trunk_to_Other_Switch"
                set switch-mode static
                set vlan "VLAN_30_MGMT"        <-- Native VLAN (e.g., for switch management)
                set allowed-vlans "VLAN_10_DATA" "VLAN_20_VOICE" "VLAN_30_MGMT" <-- Allowed tagged VLANs
                set access-mode trunk
                set status enable
            next
        end
    next
end

Note the set switch-mode static. While "mac-based" and "802.1x" exist, "static" is used for simple port-based VLAN assignments. The set access-mode untagged for access ports and set access-mode trunk for trunk ports define how traffic is handled.

Configuring Power over Ethernet (PoE)

PoE simplifies deployments by providing power and data over a single Ethernet cable. FortiGate allows granular control over PoE settings on FortiSwitch ports.

1. Enabling/Disabling PoE (GUI)

By default, PoE is often enabled on compatible ports. To explicitly control it:

  1. Navigate to WiFi & Switch Controller > FortiSwitch Ports.
  2. Select the desired FortiSwitch and port.
  3. In the configuration pane, under "PoE Status", select "Enable" or "Disable" as required.
  4. Click "Apply".

2. Configuring PoE Options (GUI)

For more advanced PoE control, such as limiting power or enabling priority:

  1. Navigate to WiFi & Switch Controller > FortiSwitch Ports.
  2. Select the desired FortiSwitch and port.
  3. Expand the "Advanced" section at the bottom of the port configuration pane.
  4. Here you can find:
    • PoE Mode: Typically "Auto" (the default), allowing the switch to negotiate power.
    • PoE Status: Enable/Disable.
    • PoE Max Power: Specify a maximum power in milliwatts (mW) if you want to limit the power budget for a specific device, useful for non-standard or older PoE devices. The default is typically based on the PoE standard (e.g., 15400mW for PoE, 30000mW for PoE+, 60000mW for PoE++).
    • PoE Pre-Standard Detection: Enable for devices that don't fully comply with IEEE 802.3af/at standards. Only enable if experiencing issues with specific devices.
    • PoE Power Priority: Set to "Critical", "High", or "Low". In scenarios where the total PoE budget of the switch is exceeded, higher priority ports will maintain power while lower priority ports may be shut down. Default is "Low".
  5. Click "Apply".

3. CLI Configuration for PoE

config switch-controller managed-switch
    edit <FortiSwitch_Serial_Number>
        config ports
            edit "port4"
                set description "PoE_AP_Lobby"
                set poe-status enable
                set poe-mode auto
                set poe-pre-standard-detection disable
                set poe-power-priority high
                set poe-max-power 25000  <-- Set max power to 25W if needed
                set vlan "VLAN_10_DATA"  <-- Example VLAN for an AP
                set status enable
            next
            edit "port5"
                set description "Camera_Outside"
                set poe-status enable
                set poe-power-priority critical
                set poe-max-power 12000  <-- 12W for a typical camera
                set vlan "VLAN_10_DATA"
                set status enable
            next
        end
    next
end

Common Pitfalls and Troubleshooting

  • VLAN not defined on FortiGate: You cannot assign a VLAN to a FortiSwitch port if that VLAN ID has not been created as a VLAN interface on the FortiGate, associated with the FortiLink interface. The FortiGate is the Layer 3 gateway for these VLANs.
  • Incorrect Native VLAN: If a device isn't receiving an IP address or can't communicate, verify the port's native VLAN. Untagged traffic from the device will be placed onto this VLAN.
  • Missing Allowed VLANs (Trunk Ports): For trunk ports, if a VLAN is not explicitly allowed, traffic for that VLAN will be dropped, even if the device on the other end is tagging it correctly.
  • LLDP-MED not enabled for Voice VLANs: Without LLDP-MED, IP phones may not correctly identify and tag their voice traffic, leading to poor voice quality or failure to register. Ensure it's enabled on the port connecting to the phone.
  • PoE Budget Exceeded: If multiple high-power PoE devices (e.g., PoE++ APs) are connected to a switch, the total power demand might exceed the switch's capacity. Check the FortiSwitch's PoE budget in WiFi & Switch Controller > Managed FortiSwitch > [Switch Name] > Details > PoE tab. Use PoE power priority to ensure critical devices remain powered.
  • PoE Pre-Standard Devices: Some older or non-standard PoE devices may require "PoE Pre-Standard Detection" to be enabled to receive power. Only enable this if necessary, as it can sometimes cause issues with standard-compliant devices.
  • FortiLink Connectivity Issues: If FortiSwitch ports are not visible or configuration changes don't apply, ensure the FortiLink connection itself is healthy. Check FortiGate logs and the FortiSwitch CLI (get system status) for FortiLink status.
  • Firmware Mismatch: Ensure your FortiGate and FortiSwitch firmware versions are compatible, especially when introducing new features or after major upgrades. Refer to the FortiSwitchOS Release Notes for compatibility matrices.

Back to the knowledge base · Ask the AI assistant