Troubleshooting Tip: FortiSwitch keeps reverting STP settings

It is recommended to perform the following steps during a maintenance window with console access to the FortiSwitch.

1. Create a Custom Script on the FortiGate.

Create a custom command to disable STP on the affected trunk interface to ensure the configuration is enforced by the FortiGate.

config switch-controller custom-command
    edit Disable-STP-AutoTrunk
        set command "config switch trunk
            edit <trunk-name>
                set stp-state disabled
            next
        end"
    next
end

Replace <trunk-name> with the appropriate trunk interface name.

2. Bind the Custom Script to the Managed FortiSwitch.

Bind the custom script to the managed FortiSwitch to ensure that the configuration is pushed from the FortiGate and maintained during synchronization.

config switch-controller managed-switch
    edit "<FortiSwitch_serial_number>"
        config custom-command
            edit 1
                set command-name "Disable-STP-AutoTrunk"
            next
        end
    next
end

Replace <FortiSwitch_serial_number> with the serial number of the affected FortiSwitch.

Binding the script ensures that the configuration is not overwritten during synchronization.

3. Configure the trunk in static mode and enable Static ISL.

To prevent dynamic modifications, configure the trunk in static mode and enable static ISL.

config switch trunk
    edit <trunk-name>
        set mode static
        set static-isl enable
    next
end

4. Delete and recreate the Trunk (if necessary).

If the configuration continues to revert, delete the existing trunk and recreate it manually from the FortiGate to ensure it is controller-managed.

config switch trunk
delete <trunk-name>
end

After deletion, recreate the trunk configuration from the FortiGate.

5. Configure Edge Port or Disable STP (if applicable).

If required by the network design, configure the relevant ports as edge ports or explicitly disable STP.

config switch-controller managed-switch
    edit "<FortiSwitch_serial_number>"
        config ports
            edit <port-name>
                set edge-port enable
                set stp-state disabled
            next
        end
    next
end

6. Verification.

After applying the changes:

• Confirm that STP is disabled on the intended trunk interfaces.

• Verify that static ISL is enabled.

• Ensure that the configuration persists after synchronization.

• Monitor the network to confirm that packet loss and instability are resolved.

Upgrading to a stable and recommended FortiSwitch firmware version is also recommended.