Stack FortiSwitches With FortiLink for Single-Pane Management

FortiLink provides a seamless, single-pane-of-glass management interface for FortiSwitch devices directly from a FortiGate firewall. This integration…

FortiLink provides a seamless, single-pane-of-glass management interface for FortiSwitch devices directly from a FortiGate firewall. This integration simplifies network administration, streamlines security policy enforcement, and offers centralized visibility over both wired and wireless infrastructure. Leveraging FortiLink with multiple FortiSwitches, either in a physical stack or logically grouped, enhances scalability and operational efficiency for campus and branch deployments.

This article details the process of connecting and managing multiple FortiSwitches via FortiLink, focusing on the configuration steps, common deployment scenarios, and key benefits such as centralized firmware upgrades and simplified VLAN management.

Understanding FortiLink Operational Modes

FortiLink operates in two primary modes: dedicated and redundant. The choice depends on your network's high-availability requirements and the number of FortiSwitches involved.

Dedicated FortiLink

In this mode, a single FortiLink interface on the FortiGate (e.g., fortilink or a custom-named hardware switch/aggregate interface) connects directly to one or more FortiSwitches. This is suitable for scenarios where a single point of failure on the FortiLink interface itself is acceptable, or where the FortiGate itself is part of an HA cluster. For multiple FortiSwitches, they typically daisy-chain or connect to a dedicated FortiLink logical interface (e.g., a software switch or aggregate interface) on the FortiGate.

Redundant FortiLink (HA FortiLink)

Redundant FortiLink provides fault tolerance for the management plane. This can be achieved in a couple of ways:

  • FortiGate HA with Single FortiLink Interface: The FortiGate units operate in an HA cluster, sharing a common FortiLink interface. If the primary FortiGate fails, the secondary takes over, and the FortiLink connection remains active.
  • Dual FortiLink Interfaces (FortiGate A-P or A-A HA): With FortiGate HA, you can configure two separate FortiLink interfaces on the FortiGate pair, each connected to different FortiSwitch units or different switches in a stack. This provides redundancy both at the FortiGate level and for the FortiLink connectivity itself. The FortiSwitches often use LACP to connect to both FortiLink interfaces.

Initial FortiSwitch Connection and Authorization

The core of FortiLink management begins with physically connecting the FortiSwitch to a designated FortiLink port on the FortiGate. The FortiGate then automatically discovers the connected switch, making it available for authorization.

Physical Connection

For a single FortiSwitch, connect one of its uplink ports (typically port 1, but check your specific model's documentation) to the FortiLink interface on the FortiGate. For multiple FortiSwitches, you can daisy-chain them (connecting an uplink of Switch 1 to the FortiGate, then an uplink of Switch 2 to a downlink of Switch 1, and so on) or connect multiple switches directly to a FortiLink aggregate interface on the FortiGate. It's best practice to use dedicated ports for FortiLink on the FortiGate, ideally an aggregate interface (LAG/LACP) if high availability and bandwidth are critical.

FortiGate FortiLink Interface Configuration

Ensure the FortiLink interface on your FortiGate is properly configured. On most FortiGates running FortiOS 6.2+, a dedicated "fortilink" hardware switch interface is often pre-created or can be created easily. If using multiple physical ports for redundancy or increased bandwidth, create a Link Aggregation Group (LAG) and assign it the FortiLink role.

config system interface
    edit "fortilink"
        set vdom "root"
        set ip 169.254.1.1 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm capwap
        set type hard-switch
        set member "port10"  # Example: using port10 for FortiLink
        set description "FortiLink Interface"
    next
end

# For a redundant/HA setup using an Aggregate interface
config system interface
    edit "FortiLink_LAG"
        set vdom "root"
        set ip 169.254.1.1 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm capwap
        set type aggregate
        set member "port11" "port12" # Example: using port11 and port12 for LAG
        set lacp-mode static # or active
        set description "FortiLink HA LAG"
    next
end

The IP address 169.254.1.1/24 is a common default for the FortiLink interface, but it can be changed. FortiSwitches connected to this interface will automatically receive an IP address in the same subnet via DHCP.

Authorization via FortiGate GUI/CLI

Once connected, the FortiSwitch will appear in the FortiGate GUI under WiFi & Switch Controller > FortiSwitch Ports > Managed FortiSwitch (or Managed Switches in newer FortiOS versions). It will typically show an "Unauthorized" status. Select the switch and click "Authorize".

From the CLI, you can list pending authorizations and authorize them:

config switch-controller managed-switch
    # To list pending switches (they'll have a NULL name)
    get
    
    # To authorize a specific switch by its serial number
    edit <FortiSwitch_Serial_Number>
        set fsw_day_zero_mclag_icp_primary disable # Default for single switch
        set description "Access Switch - Floor 1"
    next
end

After authorization, the FortiSwitch will reboot and download its configuration from the FortiGate. This process can take a few minutes.

Stacking and Managing Multiple FortiSwitches

FortiLink supports managing multiple FortiSwitches as a logical stack, even if they are not physically stacked using dedicated stacking modules. This is achieved by connecting them all to the same FortiLink interface on the FortiGate.

Logical Stacking via FortiLink

When multiple FortiSwitches are authorized under the same FortiLink interface, the FortiGate manages them as a group. Configuration, such as VLANs, port settings, and PoE, is applied centrally. For instance, if you create VLAN 100 on the FortiGate, it becomes available to all managed FortiSwitches for assignment to their ports.

You can identify each switch by its serial number in the FortiGate GUI. When configuring ports, you select the specific FortiSwitch and then the desired port number.

Firmware Upgrades

One significant advantage of FortiLink is centralized firmware management. FortiSwitches managed by FortiLink do not directly connect to FortiGuard for updates. Instead, the FortiGate downloads the appropriate FortiSwitch firmware and pushes it to all authorized switches.

To upgrade FortiSwitch firmware:

  1. Ensure your FortiGate has internet access and FortiGuard services are active.
  2. Navigate to WiFi & Switch Controller > FortiSwitch Firmware in the FortiGate GUI.
  3. The GUI will display available firmware versions. Select the desired version and click "Upgrade".
  4. You can choose to upgrade all switches immediately or schedule the upgrade.

The FortiGate will download the firmware and push it to all connected FortiSwitches, which will then reboot. This "one-click" upgrade process dramatically simplifies maintenance for large deployments.

VLAN, Port, and PoE Configuration

All network configurations for managed FortiSwitches are performed directly on the FortiGate.

VLAN Management

VLANs are defined on the FortiGate, and these definitions are automatically propagated to all managed FortiSwitches. You then assign these VLANs to specific switch ports.

  1. Create VLAN Interfaces on FortiGate: Go to Network > Interfaces and create new VLAN interfaces, parented to the FortiLink interface. For example, VLAN10 (Parent: fortilink, VLAN ID: 10).
  2. Assign VLANs to FortiSwitch Ports: Navigate to WiFi & Switch Controller > FortiSwitch Ports. Select the specific FortiSwitch port you want to configure. In the "VLAN" dropdown, you'll see all VLANs defined on the FortiLink interface. Choose the appropriate VLAN for Access or Trunk mode.
# Example: Creating VLAN 10 on FortiLink
config system interface
    edit "VLAN10_USERS"
        set vdom "root"
        set ip 10.0.10.1 255.255.255.0
        set interface "fortilink"
        set vlanid 10
        set allowaccess ping https
        set description "User VLAN"
    next
end

# Example: Assigning VLAN 10 to a FortiSwitch port
# This is typically done via GUI for easier management.
# CLI equivalent is more complex as it requires defining a port policy.
config switch-controller switch-profile
    edit "port-profile-VLAN10-access"
        config fortilink
            set port-mode access
            set access-vlan 10
        end
    next
end

config switch-controller managed-switch
    edit <FortiSwitch_Serial_Number>
        config ports
            edit "port5" # Example: Port 5 on the FortiSwitch
                set fortilink-profile "port-profile-VLAN10-access"
            next
        end
    next
end

PoE Management

Power over Ethernet (PoE) settings are also controlled from the FortiGate. For each FortiSwitch port that supports PoE, you can configure:

  • PoE Status (Enable/Disable)
  • PoE Priority (Critical, High, Low)
  • PoE Power Limit (Custom or Class-based)

This is managed under WiFi & Switch Controller > FortiSwitch Ports by selecting the specific port and configuring its PoE settings.

Common Pitfalls and Troubleshooting

  • FortiSwitch Not Appearing for Authorization:
    • Check physical cabling: Ensure the FortiSwitch uplink is connected to the FortiLink port on the FortiGate.
    • Verify FortiLink interface status: Make sure the FortiLink interface on the FortiGate is "up" and has the correct IP configuration (e.g., 169.254.1.1/24).
    • Firewall policies: Ensure no implicit or explicit firewall policies are blocking FG-FSM (FortiGate FortiSwitch Management) traffic on the FortiLink interface.
    • Factory reset FortiSwitch: If it was previously managed by another FortiGate or has a custom config, a factory reset might be necessary (execute factoryreset from FortiSwitch CLI).
    • Firmware compatibility: Ensure the FortiSwitch firmware is compatible with the FortiOS version. Consult the FortiSwitch compatibility matrix on the Fortinet support site. For example, FortiSwitch OS 7.0.x might require FortiOS 7.0.x or newer.
  • VLANs Not Propagating:
    • Ensure VLAN interfaces are created with the FortiLink interface as their parent.
    • Verify the FortiSwitch port is correctly assigned the desired VLAN (access or trunk) in the FortiGate GUI.
    • Check FortiGate logs for any errors related to FortiLink communication.
  • Firmware Upgrade Failures:
    • FortiGate internet connectivity: Ensure the FortiGate can reach FortiGuard services to download firmware.
    • Disk space on FortiGate: Verify the FortiGate has sufficient disk space to store the firmware image.
    • Network stability: Unstable network connectivity between FortiGate and FortiSwitch during the upgrade can cause issues.
  • PoE Issues:
    • Check the connected device's power requirements against the FortiSwitch's PoE budget and per-port power limits.
    • Verify PoE settings (enabled, priority) on the FortiSwitch port through the FortiGate GUI.
    • Consider using a separate PoE injector for testing if the issue persists, to rule out the device itself.
  • HA FortiLink Specifics:
    • When using dual FortiLink interfaces for HA, ensure LACP is correctly configured on both the FortiGate aggregate interface and the FortiSwitch uplinks.
    • Verify cabling ensures proper connection to both FortiGate HA members (active/passive).

Back to the knowledge base · Ask the AI assistant