Technical Tip: Preventing automatic FortiLink adoption on standalone FortiSwitch in L2-extended networks

Description

This article describes steps to investigate where in environments where Layer-2 connectivity extends between remote sites (bridges, wireless links, Metro-Ethernet, VLAN trunks, etc.), a standalone FortiSwitch may be automatically discovered and adopted by a remote FortiGate acting as a Switch Controller.

This can lead to:

• Unexpected FortiLink activation.

• Automatic VLAN deletion.

• Port configuration changes.

• Hostname changes.

• Loss of local switch configuration.

This behavior occurs because the FortiSwitch sends CAPWAP discovery packets by default, and any reachable FortiGate may respond and adopt the switch.

Scope

FortiSwitchOS v7.2.3, v7.4.0, v7.6.0, v8.0.0 and above.

Solution

Even with the following settings:

config switch global
    set auto-fortilink-discovery disable
    set auto-isl disable
end

The FortiSwitch may still be adopted by a remote FortiGate. This happens because CAPWAP discovery remains enabled.

To fix this, disable AC (Access Controller) discovery completely on FortiSwitch's CLI:

config switch-controller global
    set ac-discovery-type disable
end

This will have the following effect:

• CAPWAP discovery packets are no longer sent.

• The FortiSwitch stops advertising itself to any FortiGate.

• FortiLink auto-adoption is fully prevented.

• The switch remains standalone even across L2-extended networks.

This setting immediately stops FortiGate adoption attempts.

Recommended additional hardening.

Although not strictly required once AC discovery is disabled, Fortinet recommends:

config switch global
    set auto-fortilink-discovery disable
    set auto-isl disable
end

config switch physical-port
    edit <port>
        set lldp-profile default
    next
end

Conclusion:

Using ac-discovery-type disable is the most effective and reliable method to prevent unwanted FortiLink adoption in standalone FortiSwitch deployments, especially in networks where L2 connectivity spans multiple sites.

The original draft of this article was provided by alejandrofern43.