Troubleshooting Tip: FortiGate 90G/91G WAN interface link down after upgrade due to 1000BASE-X auto-negotiation behavior

Description

This article describes how to address an issue where, after upgrading a FortiGate 90G/91G to FortiOS 7.4.11 or later, administrators may observe that the WAN interface link remains down or becomes unstable when using fiber SFP connections configured with 1000auto.

Initial troubleshooting may suggest a physical layer issue; however, the root cause can be related to changes in 1000BASE-X Auto-Negotiation (AN) support and interface speed negotiation behavior.

Scope

FortiGate 7.4.11 and later.

Solution

Symptoms:

• The WAN interface remains down after a firmware upgrade.

• Link status fluctuates intermittently.

• An SFP transceiver is detected correctly, but no link is established.

The interface is configured with the following:

config system interface
    edit "wan1"
        set speed 1000auto
    next
end

Troubleshooting:

• Verify the physical fiber cabling and ensure the TX/RX fibers are connected correctly.

• Re-seat the fiber SFP transceiver and confirm it is properly inserted.

• Perform a hardware loopback test using a fiber loopback adapter: if the interface status changes to UP, the SFP port hardware and transceiver are functioning correctly.

Root cause:

The issue is related to 1000BASE-X Auto-Negotiation behavior on the FortiGate 90G/91G platform. In FortiOS 7.4.9, 1000BASE-X Auto-Negotiation was not supported. As a result, interfaces configured with 1000auto effectively operated without auto-negotiation.

After upgrading to FortiOS 7.4.11 or later, the interface negotiation behavior changes. In environments where the peer switch port is configured statically, a mismatch can occur if the FortiGate interface continues using 1000auto.

Solution:

Configure the FortiGate interface to use a fixed speed and duplex setting that matches the connected switch port.

FortiGate configuration:

config system interface
    edit "wan1"
        set speed 1000full
    next
end

Switch configuration:

Configure the connected switch port as follows:

• Speed: 1 Gbps.

• Duplex: Full Duplex.

Disable auto-negotiation if it is supported by the switch platform.

After both sides are configured with matching static settings, verify that the interface status changes to UP and traffic passes normally.

Verification:

Check the interface status:

get system interface physical

Or:

diagnose hardware deviceinfo nic wan1

Confirm the following:

• Link status is up.

• Speed is 1000 Mbps.

• Duplex is Full.

• Traffic passes successfully through the interface.

Conclusion:

When troubleshooting fiber link issues on FortiGate 90G/91G devices after upgrading to FortiOS 7.4.11 or later, do not focus solely on physical layer verification. If the SFP hardware and loopback tests are successful, review the interface speed configuration and ensure both the FortiGate and the peer switch use matching 1 Gbps Full-Duplex settings. Setting the interface to 1000full resolved the issue in this case, and should be considered the definitive remediation when encountering similar symptoms.