Technical Tip: FortiSwitch to FortiSwitch Manager connection config

Description

This article describes how to configure a FortiSwitch to connect to FortiSwitch Manager

Scope

FortiSwitch v6.4.x and above.

Solution

FortiSwitch Manager is an on-premises centralized management solution designed specifically for administering FortiSwitch devices.

FortiSwitch units communicate with the manager over a Layer 3 network, enabling administrators to centrally deploy, monitor, and configure large-scale switching environments from a dedicated management platform.

This deployment model is similar to FortiLink operating over a Layer 3 network, where the switches establish management connectivity to the controller across routed infrastructure rather than a direct Layer 2 FortiLink connection.

Before onboarding the switches, ensure that the FortiSwitches and FortiSwitch Manager have IP reachability to each other and that the required protocols and services, such as NTP, CAPWAP, LLDP, and ICMP, are allowed across the network.

FortiSwitch config:

1. On the upstream port of the FortiSwitch, the lld-profile needs to be changed to default:
   
   

config switch physical-port
    edit port10
        set lldp-profile default
     next
end   

2. Create the trunk.
   
   

config switch trunk
    edit "fortilink"
        set static-isl enable
        set members "port10"
    next
end

3. By default, FortiLink VLAN is 4094.
   
   

config switch auto-network
   set mgmt-vlan 4094
   set status enable
end

4. Configure the FortiSwitch Manager IP on FortiSwitch.
   
   

config switch-controller global
   set ac-discovery-type static
   config ac-list
       edit 1
          set ipv4-address 23.23.23.2 <-----
       next
   end
end

5. Add the NTP server (FortiSwitch Manager IP) to the FortiSwitch NTP config. FortiSwitch will sync its time with it.
   
   

config system ntp
    config ntpserver
       edit 1
           set server "23.23.23.2" <-----
       next
    end
    set ntpsync enable
end

6. Now, if the switch interface config is checked, it should look something like this: where the native VLAN is 4094.
   
   

sh switch interface internal
config switch interface
    edit "internal"
        set native-vlan 4094 <------ Internal interface will only have vlan 4094
        set stp-state disabled
        set snmp-index 53
    next
end
sh switch interface fortilink
config switch interface
    edit "fortilink"
        set native-vlan 4094
        set allowed-vlans 1,22,4088-4094 <----- All l2 VLANs are allowed by default.
        set dhcp-snooping trusted
        set stp-state disabled
        set edge-port disabled
        set snmp-index 56
    next
end

7. By default, the internal interface is set to DHCP mode, but here it is configured in static mode.
   
   

config system interface
    edit "internal"
        set mode static
        set ip 21.21.21.2 255.255.255.0
        set allowaccess ping https ssh
        set type physical
        set secondary-IP enable
        set snmp-index 55
        config secondaryip
            edit 1
                set ip 192.168.1.99 255.255.255.0
                set allowaccess ping https ssh
            next
        end
   next
end

After completing the previous configuration steps, the FortiSwitch should be successfully managed by FortiSwitch Manager.

execute switch-controller get-conn-status
Get managed-switch xxxxx connection status:
Connection: Connected
Image Version: FG120G-v7.6-build3652
Remote Address: 23.23.23.2
Join Time: Tue Jun 2 14:15:43 2026
DTLS Version: DTLSv1.2