Cannot access FortiGate WebUI after changing switch-controller-mgmt-vlan to 1363 (FortiOS 7.4.11)

Forum|Forum|4 months ago
March 25, 2026
4 replies
290 views

Hello everyone,

I have a FortiGate 60F with a FortiSwitch 108E-POE running FortiOS 7.4.11.

I changed the FortiLink management VLAN from the default (4094) to our university VLAN 1363 using the following commands:

text

config system interface     edit fortilink         set switch-controller-mgmt-vlan 1363     next end

After applying the change, I can no longer access the FortiGate WebUI (neither HTTPS nor HTTP) from VLAN 1363. Interestingly, ping to the FortiGate IP on the 1363.fortilink sub-interface works fine.

The only workaround I’ve found so far is to create an additional VLAN (1364) on top of fortilink exclusively for FortiGate management, assign the IP address there, and enable allowaccess.

My question: Is there a way to access the FortiGate WebUI using only VLAN 1363 (the same VLAN used for FortiLink management) without having to create a second VLAN?

I also tried disabling the client certificate requirement with:

text

config system global     set admin-https-client-cert disable end

However, the setting does not persist — when I run get system global, it still shows as enabled.

I’ve checked the official documentation and searched the forum but couldn’t find anyone with this exact scenario. Has anyone managed to solve this cleanly using a single management VLAN?

Any help or experiences would be greatly appreciated.

Thank you very much in advance!

funkylicious

SuperUser

hi,

you might need to set the mgmt ip address directly on the fortilink interface for vlan 1363 and not create a subinterface for it.

on the switch port connecting to the fortilink this might need to be native vlan and not tagged.

"jack of all trades, master of none"

dsotilloAuthor

New Member

Hi,

Thanks for the suggestion!

Could you please clarify how exactly to do that?

Right now I have the management VLAN set with this command:

text

config system interface     edit fortilink         set switch-controller-mgmt-vlan 1363     next end

And I created a VLAN sub-interface 1363.fortilink with the IP address and set allowaccess https http ping.

Do you mean I should remove the VLAN sub-interface and instead put the IP address directly on the fortilink interface itself?

Something like this?

text

config system interface     edit fortilink         set ip 10.0.136.1 255.255.255.0     <--- your management IP/subnet         set allowaccess https http ping         set switch-controller-mgmt-vlan 1363     next end

On the FortiSwitch side, for the port connected to the FortiGate (the FortiLink uplink), should I set it as native VLAN 1363 (untagged) instead of a tagged trunk?

text

config switch interface     edit "portX"          <--- the port connected to FortiGate         set native-vlan 1363         set allowed-vlans 1363   <--- or whatever other VLANs you need     next end

Is that the correct approach?

I’d really appreciate the exact steps, because when I tried putting the IP directly on fortilink before, the WebUI still didn’t respond from VLAN 1363.

Thanks again for your help!