Troubleshooting Tip: Device Detection Issue on FortiSwitch Ports

Description

This article describes how to troubleshoot and resolve an issue where endpoint device information is not displayed for devices connected to FortiSwitch ports managed via FortiLink.

Scope

FortiGate (all models), FortiSwitch (managed via FortiGate / FortiLink).

Solution

In this scenario, FortiGate continues to detect endpoint devices internally, but device data is not properly reported or synchronized to the FortiSwitch port view. This can affect network visibility, device tracking, and policy enforcement.

Before proceeding with the steps below, confirm the issue matches the following behavior:

• No MAC address or IP address is visible under switch port views in the GUI or CLI

• Device data that was previously visible is no longer displayed

• diagnose user device list returns device entries on the FortiGate side

• diagnose switch-controller mac-cache shows missing or incomplete entries

• Wireless devices may appear correctly, but wired devices connected to FortiSwitch ports do not

The issue is typically caused by one or both of the following conditions:

Unintended automation script: An auto-script (e.g., Kill-FLCFGD) is configured to periodically restart the flcfgd process, commonly every 30 minutes. This daemon is responsible for FortiLink configuration and synchronization. Repeated restarts interrupt the synchronization cycle between FortiGate and FortiSwitch, causing device data to be lost or not populated.

Incorrect data synchronization interval: The data-sync-interval parameter under the switch-controller system is set to 0, which disables polling entirely. Without a valid interval, FortiGate does not request device information updates from the FortiSwitch, resulting in stale or absent data.

Troubleshooting steps:

Identify and Remove the Interfering Auto-Script.

Check whether an automation script targeting the flcfgd process exists:

config system auto-script
show
end

If a script such as Kill-FLCFGD is present, delete it:

config system auto-script
delete "Kill-FLCFGD"
end

Important: Before deleting any script, review all configured auto-scripts to ensure no other critical automation tasks are impacted. If the script was created as a workaround for a memory or stability issue, investigate the underlying root cause rather than restoring the script after this fix.

Configure the data synchronization interval.

Verify the current value of data-sync-interval:

config switch-controller system
show
end

If the value is 0, update it to a valid interval. The recommended value is 300 seconds (5 minutes), which provides a reliable balance between data accuracy and system performance:

config switch-controller system
set data-sync-interval 300
end

Note: A value of 0 disables synchronization entirely. Any non-zero value re-enables polling. Adjust the interval based on environment size and performance requirements.

After applying the changes above, wait at least 1 hour before validating. This time allows:

• Internal MAC and device caches to rebuild.

• FortiGate and FortiSwitch to complete a full resynchronization cycle.

• Port-to-device mappings to repopulate correctly.

Additional recommendations:

Avoid using automation scripts to restart critical FortiLink processes (flcfgd, fcnacd, etc.) unless explicitly directed by Fortinet TAC.

If the Kill-FLCFGD script was created due to a memory leak or process instability, open a TAC case in the Support portal to investigate the root cause on the current firmware version.

If FortiNAC or another NAC solution is integrated, verify that API tokens and connection settings remain valid after the configuration changes.

Consider enabling logging for switch-controller events to detect future synchronization disruptions early.