Technical Tip: FortiSwitch Offline with Event old_state 13

Description

This article describes one of the reasons why a FortiSwitch may go offline and generate the event old_state 13.

Scope

FortiSwitch, FortiGate.

Solution

• One of the conditions that causes a FortiSwitch to reconnect to the FortiLink interface is a hostname change on the FortiSwitch.
  Refer to article:
  Defining names for managed switches
  
  

• When the hostname is changed, the FortiSwitch temporarily disconnects and reconnects to FortiGate.
  The following sequence is typically observed in the event logs:
  
  

29: 2026-08-13 08:25:45 log_id=0106013000 tz=+0200 type=event subtype=switch_controller pri=notice vd=root action=switch-config-set status=connected msg="Switch-Controller: connected with FortiGate"

30: 2026-08-13 08:22:46 log_id=0106013003 tz=+0200 type=event subtype=switch_controller pri=notice vd=root msg="FortiLink: port58 in Fortigate-uplink ready now"

31: 2026-08-13 08:22:46 log_id=0106013018 tz=+0200 type=event subtype=switch_controller pri=critical vd=root msg="FortiLink: disabled port port58 port-id=58 from b(0) fwd(4)"

32: 2026-08-13 08:22:46 log_id=0106013001 tz=+0200 type=event subtype=switch_controller pri=notice vd=root switch.physical-port="port58" msg="FortiLink: port58 joined Fortigate-uplink trunk-id(4)"

33: 2026-08-13 08:22:44 log_id=0106013006 tz=+0200 type=event subtype=switch_controller pri=notice vd=root action=caputp-disconnect msg="Switch-Controller: CAPWAP Tunnel down with event 26 old_state 13"

37: 2026-08-13 08:22:42 log_id=0106013005 tz=+0200 type=event subtype=switch_controller pri=warning vd=root msg="FortiLink: port58 echo reply timed out"

38: 2026-08-13 08:22:42 log_id=0103030800 tz=+0200 type=event subtype=system pri=information vd=root action="daemon-startup" user="init" ui="None" daemon="l2dbg" pid="3213" msg="Daemon l2dbg started"

39: 2026-08-13 08:22:41 log_id=0103030801 tz=+0200 type=event subtype=system pri=information vd=root action="daemon-shutdown" ui="None" user="init" daemon=l2dbg pid=3139 msg="Daemon l2dbg shut down"

41: 2026-08-13 08:22:31 log_id=0106013005 tz=+0200 type=event subtype=switch_controller pri=warning vd=root msg="FortiLink: port58 echo reply timing out echo-miss(50)"

43: 2026-08-13 08:22:21 log_id=0106013005 tz=+0200 type=event subtype=switch_controller pri=warning vd=root msg="FortiLink: port58 echo reply timing out echo-miss(40)"

45: 2026-08-13 08:22:11 log_id=0106013005 tz=+0200 type=event subtype=switch_controller pri=warning vd=root msg="FortiLink: port58 echo reply timing out echo-miss(30)"

47: 2026-08-13 08:22:01 log_id=0106013005 tz=+0200 type=event subtype=switch_controller pri=warning vd=root msg="FortiLink: port58 echo reply timing out echo-miss(20)"

48: 2026-08-13 08:21:58 log_id=0103042802 tz=+0200 type=event subtype=system pri=information vd="root" user="FortiLink" ui="httpsd" action=edit cfg_tid=169869742 cfg_path="system.global" cfg_attr="hostname[RB-SWC-FO-1->RB-SWF-CORE1]" msg="Edit system.global "

49: 2026-08-13 08:21:58 log_id=0103030514 tz=+0200 type=event subtype=system pri=notice vd=root user="FortiLink" ui=httpsd field=hostname old_value="RB-SWC-FO-1" new_value="RB-SWF-CORE1" msg="User FortiLink changed hostname global setting to RB-SWF-CORE1 from httpsd"

This behavior is expected because changing the hostname triggers a FortiLink reconnection process.