Troubleshoot a FortiSwitch That Won't Authorize

When integrating a FortiSwitch into a FortiLink-managed environment, successful authorization by the FortiGate is paramount for centralized control,…

When integrating a FortiSwitch into a FortiLink-managed environment, successful authorization by the FortiGate is paramount for centralized control, policy enforcement, and network visibility. An unauthorized FortiSwitch remains an unmanaged device, limiting its utility. This guide outlines a structured approach to diagnose and resolve common issues preventing FortiSwitch authorization, focusing on FortiGate-FortiSwitch OS versions 6.0 and later, where FortiLink operates as a dedicated management protocol.

The authorization process typically involves the FortiSwitch discovering the FortiGate, presenting its serial number, and the FortiGate subsequently approving and provisioning the switch. Failures in any step require systematic troubleshooting.

Initial Checks and Prerequisites

Before diving into deeper diagnostics, ensure the fundamental setup is correct. These steps often resolve the majority of authorization failures.

Physical Connectivity

• Cable Integrity: Verify the Ethernet cable connecting the FortiSwitch to the FortiGate is intact and properly seated. Test with a known good cable if in doubt.
• Link Lights: Check the link status LEDs on both the FortiGate FortiLink port and the connected FortiSwitch port. A solid green or amber light (depending on speed) indicates physical link. No light suggests a cabling or port issue.
• Interface Speed/Duplex: While FortiLink generally auto-negotiates, mismatched settings can cause instability. Confirm both ends are set to auto-negotiate or manually configured to matching speeds (e.g., 1Gbps Full Duplex).

FortiGate FortiLink Interface Configuration

The FortiGate interface designated for FortiLink must be correctly configured. Use the FortiGate CLI:

config system interface
    edit <FortiLink_Interface_Name>
        set mode fortilink
        set ip 169.254.1.1 255.255.255.0  <-- Default IP for FortiLink subnet
        set allowaccess ping https ssh http telnet fgfm
        set fortilink enable
        set auto-auth enable <-- Optional, but simplifies initial deployment
    next
end

• Ensure set mode fortilink is present. If it was previously a standard interface, changing the mode will clear its previous configuration.
• The IP address 169.254.1.1/24 is the default for a FortiLink interface when first configured. It's crucial for the FortiSwitch to obtain an IP within this subnet (usually via DHCP from the FortiGate) to communicate with the FortiGate.
• set allowaccess fgfm is critical for the FortiGate to manage the switch.
• set auto-auth enable allows switches to authorize automatically if they meet discovery criteria. For secure environments, this might be disabled, requiring manual authorization.

FortiSwitch Factory Default State

A FortiSwitch must be in its factory default state to be discovered and authorized by a new FortiGate. If a FortiSwitch was previously managed by another FortiGate or manually configured, it might retain old settings preventing authorization.

To factory reset a FortiSwitch via its console (USB or RJ45 serial port, typically 9600 baud, 8N1):

execute factoryreset

Confirm with 'y'. The switch will reboot with default settings. Once it reboots, connect it to the FortiGate's FortiLink port. If the switch is still unauthorized after a factory reset, ensure it is truly in a default state by checking its configuration via console. Look for show full-configuration and verify no static IPs, VLANs, or FortiLink settings are present.

FortiGate-Side Diagnostics

Once initial checks are done, use the FortiGate's diagnostic tools to understand the authorization status.

FortiLink Discovery Status

The FortiGate provides detailed information about discovered and authorized switches. This is the primary command to check discovery state:

diagnose switch-controller switch-info status

Look for the FortiSwitch serial number in the output. Key fields include:

• Serial Number: The unique identifier of the switch.
• Status: Should be "Authorized" for a managed switch. "Pending" or "Discovery" indicates it's seen but not yet authorized. "Unreachable" means the FortiGate can't communicate with it.
• Managed: "Managed" or "Unmanaged".
• Firmware: The FortiSwitch OS version. Mismatched major versions (e.g., FortiGate 6.4 and FortiSwitch 7.0) can cause issues; minor version mismatches are usually fine but should be updated.
• IP: The IP address the FortiSwitch obtained from the FortiGate's FortiLink DHCP server. This is critical for communication.

If the switch's serial number doesn't appear after a few minutes, the FortiGate isn't even seeing its discovery packets. This points back to physical connectivity or basic FortiLink interface configuration issues on the FortiGate.

Authorizing a Pending Switch

If diagnose switch-controller switch-info status shows the switch as "Pending" and auto-auth is not enabled or working, you'll need to manually authorize it:

config switch-controller managed-switch
    edit <FortiSwitch_Serial_Number>
        set authorized enable
    next
end

After enabling authorization, the switch status should change to "Authorized" within a minute or two, and it will begin downloading the configuration from the FortiGate.

FortiSwitch-Side Diagnostics (via Console)

When the FortiGate isn't seeing the switch, or the switch status remains stuck, direct console access to the FortiSwitch is invaluable.

FortiLink Configuration Check

Verify the FortiSwitch's FortiLink discovery mode. After a factory reset, it should default to FortiLink mode, attempting to discover a FortiGate.

get switch-controller switch-info

Look for:

• FortiLink Mode: Should be "Auto".
• Status: "Discovery" or "Authorized".
• Master FortiGate: The IP address of the FortiGate it's trying to connect to.

DHCP and IP Address

The FortiSwitch needs an IP address from the FortiGate's FortiLink interface to communicate. Check if it successfully obtained one:

get system interface port <FortiLink_Port>
get system interface port1  <-- Default FortiLink uplink on many FortiSwitch models

Identify the port connected to the FortiGate and check its IP configuration. It should be DHCP-assigned within the FortiLink subnet (e.g., 169.254.1.X). If no IP is assigned or it's a 169.254.X.X APIPA address not from the FortiGate, it indicates a DHCP failure.

Verify the FortiGate's FortiLink interface has the DHCP server enabled:

config system dhcp server
    edit 1
        show full-configuration
    next
end

The DHCP server for the FortiLink interface should be configured and active.

FortiLink Protocol Debugging

To see the actual FortiLink communication, enable debugs on the FortiSwitch console:

diagnose debug application fortilink -1
diagnose debug enable

You should see output related to FOS (FortiSwitch OS) and FGT (FortiGate) communication, including discovery packets and attempts to connect. Look for errors related to FortiGate IP addresses or connection failures. To stop debugging: diagnose debug disable.

Advanced Troubleshooting and Edge Cases

Firmware Incompatibility

Significant FortiSwitch OS and FortiGate FortiOS version mismatches can prevent authorization. As a general rule, FortiSwitch OS should be compatible with the FortiGate FortiOS. Refer to the Fortinet compatibility matrix for specific guidance.

Example: FortiGate running FortiOS 7.0.x and FortiSwitch running FortiSwitchOS 6.4.x might work, but FortiSwitchOS 6.2.x with FortiOS 7.0.x might have issues. Always try to keep them on closely matched versions.

Inter-VDOM FortiLink (FortiGate-VM only)

For FortiGate-VM deployments using VDOMs, FortiLink can be configured in a non-root VDOM. Ensure that if FortiLink is in a non-root VDOM, the associated management VDOM is correctly set up, and the FortiSwitch is connected to an interface within that VDOM.

Topology and Uplink Redundancy

In redundant FortiLink topologies (e.g., dual-homed switches), ensure both FortiLink ports on the FortiGate are configured correctly. Spanning Tree Protocol (STP) might interfere if not properly configured (e.g., BPDU filtering on edge ports, or root bridge priorities). While FortiLink handles its own redundancy, misconfigurations can still impact initial authorization.

Security Policy or Firewall Issues (Less Common for Direct FortiLink)

If the FortiLink interface is behind a VDOM link or routing is involved (rare for direct FortiLink), ensure no firewall policies block FGT-FGFM traffic (TCP/8013 by default) between the FortiSwitch and FortiGate. For a direct connection, this is almost never the cause as the FortiLink interface itself handles the traffic.

Common Pitfalls

• Not factory resetting: Reconnecting a FortiSwitch that was previously managed by another FortiGate or had manual configuration will almost certainly fail authorization unless reset.
• Incorrect FortiLink interface mode: The FortiGate interface must be set mode fortilink.
• Missing set fortilink enable: A common oversight when configuring the FortiGate FortiLink interface.
• DHCP failure: If the FortiSwitch doesn't get an IP address from the FortiGate's FortiLink interface, it cannot communicate. Check the DHCP server on the FortiGate.
• Firmware incompatibility: Always verify FortiSwitchOS and FortiOS compatibility.
• Insufficient wait time: Authorization is not instantaneous. After making changes, allow a few minutes for the FortiSwitch to reboot (if factory reset) and for discovery/authorization to complete.