FortiGate unable to fully manage FortiSwitches

Hi All, 

Version

FortiGate-81F v7.4.8,build9191,260511 (FIPS-CC-74-8)

FIPS-CC mode: enable

FortiSwitch-148F-FPOE v7.4.8,build0929,250909 (GA)

Security mode: none

In our environment, Federal Information Processing Standards (FIPS) is required due to the contract we have. I have been running into the following issues while testing FIPS mode on our equipment.

The FortiSwitches appear under Managed FortiSwitches. I can see the firmware version, status, and join time, but I cannot SSH into the switches from the GUI. It also does not show the Connecting From status or the switch IP address.

Under FortiSwitch Ports, the port connecting the FortiGate and the FortiSwitch shows as down. When I assign a VLAN to a FortiSwitch port, the VLAN assignment is accepted, but it does not actually take effect on the connected device.

However, from the FortiGate CLI, I can SSH into the switch without any issues. The switch status is visible, but it appears that the configuration is not being fully synchronized to the switch.

Another issue is that I cannot SSH from the FortiGate to a switch running FortiSwitch v7.6.6. or any code above 7.4.8. I receive the following error:

DR-FW (root) (STS)# exec ssh admin@10.255.2.3
Unable to negotiate with 10.255.2.3: no matching host key type found. Their offer: ssh-ed25519

I tried adding the host key and also regenerating it, but neither resolved the issue.

Has anyone experienced these issues? I've been working with Fortinet Support for over a month, but we haven't made any progress.

Some comments: 

FortiWiFi-81F-2R-3G4G-DSL (root) # execute switch-controller get-conn-status 
Managed-devices in current vdom root:

FortiLink interface : Fortilink
SWITCH-ID                             VERSION           STATUS         FLAG   ADDRESS              JOIN-TIME            SERIAL          
S148FFTF25037690                      v7.4.8 (929)      Authorized/Down 2                    N/A                         S148FFTF25037690

         Flags: C=config sync, U=upgrading, S=staged, D=delayed reboot pending, E=config sync error, 2=L2, 3=L3, V=VXLAN, T=tunnel, X=External
         Managed-Switches: 1 (UP: 0 DOWN: 1 MAX: 24)

Do ssh from the cli

FortiWiFi-81F-2R-3G4G-DSL (root) # execute ssh admin@10.255.2.4
admin@10.255.2.4's password: 
SW2 # 
 

Fortigate port to the switch 

FortiWiFi-81F-2R-3G4G-DSL (a) # show full-configuration 
config system interface
    edit "a"
        set vdom "root"
        set distance 5
        set priority 1
        set dhcp-relay-interface-select-method auto
        set dhcp-classless-route-addition disable
        set status up
        set type physical
        set src-check enable
        set description ''
        set alias ''
        set ike-saml-server ''
        set estimated-upstream-bandwidth 0
        set estimated-downstream-bandwidth 0
        set measured-upstream-bandwidth 0
        set measured-downstream-bandwidth 0
        set bandwidth-measure-time 0
        set monitor-bandwidth disable
        set role undefined
        set snmp-index 9
        set preserve-session-route disable
        set ap-discover enable
        set switch-controller-mgmt-vlan 4094
        set switch-controller-igmp-snooping-proxy disable
        set switch-controller-igmp-snooping-fast-leave disable
        set swc-first-create 0
        set eap-supplicant disable
        set dhcp-relay-source-ip 0.0.0.0
        set dhcp-relay-circuit-id ''
        set dhcp-client-identifier ''
        set dhcp-renew-time 0
        set dns-server-override enable
        set dns-server-protocol cleartext
        set speed auto
    next
end

Switch port to the fortigate:

SW2 (port47) # show full-configuration 
config switch physical-port
    edit "port47"
        set cdp-status disable
        set lldp-profile "default-auto-isl"
        set poe-status enable
        set status up
    next

FortiLink Port (note I did turn off fortilink-split-interface disable and enable it any but no luck)

config system interface
    edit "Fortilink"
        set vdom "root"
        set vrf 0
        set fortilink enable
        set switch-controller-source-ip outbound
        set mode static
        set dhcp-relay-interface-select-method auto
        set dhcp-relay-service disable
        set ip 10.255.2.1 255.255.255.0
        set allowaccess ping fabric
        set fail-detect disable
        set pptp-client disable
        set arpforward enable
        set broadcast-forward disable
        set bfd global
        set l2forward disable
        set icmp-send-redirect enable
        set icmp-accept-redirect enable
        set reachable-time 30000
        set vlanforward disable
        set stpforward disable
        set ips-sniffer-mode disable
        set ident-accept disable
        set ipmac disable
        set status up
        set netbios-forward disable
        set wins-ip 0.0.0.0
        set type aggregate
        set netflow-sampler disable
        set sflow-sampler disable
        set src-check enable
        set sample-rate 2000
        set polling-interval 20
        set sample-direction both
        set explicit-web-proxy disable
        set explicit-ftp-proxy disable
        set proxy-captive-portal disable
        set tcp-mss 0
        set inbandwidth 0
        set outbandwidth 0
        set egress-shaping-profile ''
        set ingress-shaping-profile ''
        set spillover-threshold 0
        set ingress-spillover-threshold 0
        set weight 0
        set external disable
        set member "a" "b"
        set description ''
        set alias ''
        set l2tp-client disable
        set ike-saml-server ''
        set device-identification disable
        set lldp-reception enable
        set lldp-transmission enable
        set lldp-network-policy ''
        set estimated-upstream-bandwidth 0
        set estimated-downstream-bandwidth 0
        set measured-upstream-bandwidth 0
        set measured-downstream-bandwidth 0
        set bandwidth-measure-time 0
        set monitor-bandwidth disable
        set vrrp-virtual-mac disable
        set role undefined
        set snmp-index 19
        set secondary-IP disable
        set preserve-session-route disable
        set auto-auth-extension-device enable
        set ap-discover enable
        set fortilink-neighbor-detect fortilink
        set ip-managed-by-fortiipam disable
        set fortilink-split-interface disable
        set switch-controller-netflow-collect disable
        set switch-controller-mgmt-vlan 4094
        set switch-controller-igmp-snooping-proxy disable
        set switch-controller-igmp-snooping-fast-leave disable
        set switch-controller-nac "Fortilink"
        set switch-controller-dynamic "Fortilink"
        set switch-controller-iot-scanning disable
        set swc-first-create 255
        set eap-supplicant disable
        config ipv6
            set ip6-mode static
            set nd-mode basic
            set ip6-address ::/0
            unset ip6-allowaccess
            set icmp6-send-redirect enable
            set ra-send-mtu enable
            set ip6-reachable-time 0
            set ip6-retrans-time 0
            set ip6-hop-limit 0
            set dhcp6-prefix-delegation disable
            set dhcp6-information-request disable
            set vrrp-virtual-mac6 disable
            set vrip6_link_local ::
            set ip6-send-adv disable
            set autoconf disable
            set dhcp6-relay-service disable
        end
        set priority 1
        set dhcp-relay-source-ip 0.0.0.0
        set dhcp-relay-circuit-id ''
        set dhcp-client-identifier ''
        set dhcp-renew-time 0
        set idle-timeout 0
        set disc-retry-timeout 1
        set padt-retry-timeout 1
        set dns-server-override enable
        set dns-server-protocol cleartext
        set wccp disable
        set drop-overlapped-fragment disable
        set drop-fragment disable
        set mtu-override disable
        set lacp-mode static
        set lacp-ha-secondary enable
        set system-id-type auto
        set lacp-speed slow
        set min-links 1
        set min-links-down operational
        set algorithm L4
        set link-up-delay 50
        set aggregate-type physical
    next 
end