Skip to main content
Rlinkov
Staff
Rlinkov
Staff
March 23, 2026

Technical Tip: Managed FortiSwitch redundancy for Access-VLAN feature

  • March 23, 2026
  • 0 replies
  • 469 views
Description

This article describes the behavior of the 'fortilink-split-interface' feature, when to validate the correct setting of 'fortilink-neighbor-detect' FortiLink or LLDP, and in scenarios make it necessary to set it to 'fortilink'.

This is especially important when upgrading a FortiGate managing any FortiSwitch(es) to the major release of 7.6.1 and above, and if both of the following conditions are met:

 

  1. MCLAG technology is not used or is not available, such as in smaller 1xx switch models.
  2. Micro-segmentation is configured:

 

FortiGate:

  • 'Block intra-VLAN traffic enabled' (GUI).


Block intra-VLAN traffic.png

 

  • 'set switch-controller-access-vlan enable' (CLI).


access-vlan.png

 

FortiSwitch:

  • 'access-vlan enable' (CLI).


sw-access-vlan.png
Scope FortiOS 7.6.1+.
Solution

In cases where both of the conditions are met, change the following setting on the FortiGate managing the switches:

 

config system interface

    edit fortilink

        set fortilink-neighbor-detect fortilink

    end

 

This is because, starting from FortiOS 7.6.1, the default 'fortilink-neighbor-detect' is updated to LLDP instead.

If the detect mode will be left on LLDP (the new default) with ring topologies/no MCLAG and with the default 'fortilink-split-interface' enabled (as it should with ring topologies) will have an impact on any VLANs configured to block intra-VLAN traffic if a failover event occurs.

 

The failover can either be for the existing FortiGate FortiLink members, resulting in a new member actively forwarding traffic, or a complete switch failure/shutdown/disconnection.

 

Consider the following topology example illustrating the issue:

 

access-vlan.png

 

A fully detailed explanation on how 'fortilink-split-interface' mechanism works when the detect mode is LLDP or FortiLink can be found in Technical Tip: Expected behavior of the FortiGate FortiLink aggregate interface 'split interface' option with multiple FortiSwitches connected to the FortiGate.
Terms & ConditionsAccessibility statement