Skip to main content
awasfi_FTNT
Staff
awasfi_FTNT
Staff
June 5, 2026

Technical Tip: FortiSwitch Manager vs Per-Device FortiSwitch Management in FortiManager

  • June 5, 2026
  • 0 replies
  • 83 views

Description

This article explains the difference between managing FortiSwitches centrally through FortiSwitch Manager and managing them individually through per-device management in FortiManager.

It also describes the possible impact when the same VLAN or interface is managed in both places, which can lead to existing FortiGate settings being overwritten during installation.


Scope


FortiManager.


Solution


There are two different management approaches, and it is important to understand the difference before deciding which one to use.

  1. FortiSwitch manager: FortiSwitch Manager is used for centralized switch management.


It allows VLANs, switch templates, port settings, and profiles to be created once and reused across multiple FortiGates and FortiSwitches. This is useful when many sites follow the same design and need a standard configuration.

However, when FortiSwitch Manager is used, the VLANs and templates defined there can become part of the configuration FortiManager installs to the FortiGate.

A VLAN in FortiSwitch Manager is not just a VLAN name or VLAN ID. It may also include interface-related settings such as:

  • IP addressing.

  • DHCP configuration.

  • DHCP reservations.

  • Administrative access.

  • Per-device mappings.

  • Other VLAN interface parameters.

Because of this, FortiSwitch Manager can directly affect the VLAN interface configuration on the FortiGate. If the VLAN exists on the FortiGate with a complete configuration, but the same VLAN exists in FortiSwitch Manager with only partial settings, FortiManager may push the FortiSwitch Manager version during the next install.

This can result in existing FortiGate settings being changed or removed. Examples of affected settings include:

  • DHCP server configuration.

  • DHCP reservations.

  • Interface IP settings.

  • Administrative access.

  • Other interface-level settings.


  1. FortiSwitch per-device management:


FortiSwitch per-device management is more suitable when each FortiGate or site has its own specific configuration.

Instead of relying mainly on shared templates, the switch configuration is handled per device or per site.

This is usually better when sites have different requirements, such as:

  • Different VLAN IDs.

  • Different IP ranges.

  • Different DHCP scopes.

  • Different DHCP reservations.

  • Different switch port layouts.

  • Different local interface settings.

Per-device management gives more control per location and reduces the risk of a shared central template overwriting site-specific configuration.

When both are used:


The issue usually starts when the same VLAN or interface is managed from two different areas:

  • Device Manager / FortiGate configuration.

  • FortiSwitch Manager VLANs or templates.

In this situation, FortiManager may not always use the expected configuration during installation, especially if the VLAN details are different between the two places.


The FortiGate may already have a complete and working VLAN configuration under Device Manager, including DHCP, reservations, IP addressing, and access settings.

 

Later, when FortiSwitch Manager is enabled and a switch template is applied, FortiManager may also have a VLAN definition for the same network under FortiSwitch Manager.

 

If that FortiSwitch Manager VLAN does not contain the full configuration, FortiManager may still use it during installation. As a result, the FortiGate can receive an incomplete configuration of the VLAN settings.

 

This means FortiManager is installing the configuration from the FortiSwitch Manager which considered the current configuration for the managed FortiSwitch setup.

 

FortiSwitch Manager and Per-Device management do not automatically synchronize with each other. A change made under Device Manager is not automatically reflected in FortiSwitch Manager, and a change made in FortiSwitch Manager may not preserve all existing FortiGate settings.

 

This can also affect automation. For example, if DHCP settings are updated using CLI scripts or Jinja templates, those changes may later be overwritten by FortiSwitch Manager during the next install.

 

The safest approach is to define one place of configuration for VLAN and FortiSwitch.

 

If the environment is standardized and most sites follow the same design, use FortiSwitch Manager. In this case, the full VLAN configuration should be maintained there, including DHCP settings, reservations, administrative access, interface parameters, and per-device mappings.

 

If each site has different VLANs, IP ranges, DHCP scopes, reservations, or switch port layouts, use per-device management. This gives more flexibility and reduces the chance of a shared template overwriting local settings.

 

Avoid managing the same VLAN from both Device Manager and FortiSwitch Manager unless the configuration is fully aligned in both places.

 

Before installing changes, always review the FortiManager install preview. If the preview shows for example DHCP settings being removed, reservations being deleted, interface IPs changing, or administrative access being unset, this is a sign that FortiManager is about to push a different configuration of the VLAN.

    Terms & ConditionsAccessibility statement