Skip to main content
dan
dan
Explorer II
June 11, 2024
Solved

FortiSwitch setup - best practices for new installation on a remote site

  • June 11, 2024
  • 3 replies
  • 11251 views

 

I need to install a few FortiSwitches (FS) as replacement for very old cisco switches in a quite remote site.

I already got the switches here in my office and wanted to prepare them before I go onsite. 

How should or could I prepare the FortiSwitches here in my lab to reduce onsite time?

 

The FS will be connected via FortiLink (FL)to a local Fortigate 40F with FortiOS 7.0.14

40F(FL)---FS124---FS148---FS148

                    |

                FS148

 

Uplinks are FO 10GB, no reduncancy, so I need to connect the switches mostlty in serial order. See in the schema above. I should be able to connect the FS with FortiLink in parallel to the Cisco setup.

The old Cisco setup is pretty straightforward. Just two VLAN's.  

 

Actual Cisco Switch (CS) setup looks like this here:

40F(LAN1)---CS24---CS48---CS48---CS48

                                     |

                                  CS48

 

That said, what can I do to prepare?

  • Can I register the FS devices? Does it make sense?
  • Can I do firmware upgrades in standalone mode? Or should I rather wait until I connect the FS with the local FortiGate?
  • What firmware should the FortiGate have, and what firmware version the FortiSwitches?
  • Ho do I move all setings (LAN, VLAN's, networks, policies, etc) from LAN1 to FortiLink? Do I have to recreate everything again?
  • What is the best way to replace the cisco switches with the fortiswitches in general?

Thanks

Dan

 

 

Best answer by dan

Thanks for the detailed explanation @Jeremy5385 ,

 

I actually tried moving with the "Integrate Interface" funktion, but that failed. It said that the task needs to be done manually. It was not such a complex setup after all, so I edited the config file and rebooted with it. No errors. I only had to move the VLAN's unterneath the fortilink adapter. All other configuration was not affected. 

 

VLAN's were now on fortilink and the LAN1 port was "empty", so no internet for the whole building. I created an interface that provided the needed VLAN's and connected it back to the cisco switch. 

 

This are the steps I've done:

- Cleaned up computerroom to get some room to work in (we just took over responsibility)

- Setup complete FortiSwitch (FS) infrastructure (FO cabling) on a table and connected to the fortigate (FGT). 

- When I got the topology set up, updated all switches.

- Made room in the rack for the new switch close to the old switch

- Mounted the new central FS just above the old cisco switch

- Mounted the other FS switches in an empty rack just beside the main rack

- Cabled all switches via fortilink on copper cables, similar to the final setup. 

- Tested and made sure fortilink topology was ok

- Prepared a port on the old cisco central switch, connected it with the FS central switch.

- Moved the VLAN's over to fortilink by editing the config file and rebooted

- Cisco network did not have internet access, as LAN1 did not hold the VLAN's anymore

- Checked the FGT configuration, all ok

- Applied the moved VLAN's to the prepared port on the new FS central switch 

- Moved the cisco port cabling from LAN1 to the prepared FS port. Cisco network had Internet again.

- I got me some time now. FO uplinks to other cisco switches remained in place for the time being.

- Assigned VLAN's to FS ports. I made my work simple by configuring identically to the old cisco switches. 

- Moved all physical connections from the old cisco central switch to the new FS central switch. - Short interrupts for some end-devices, but it's vacation time in that building and no soul is around. 

- Now did the same for each other switch the same way.

- Made room in the rack fort the new FS, close to the old cisco switch

- Mounted the new FS beneath or above the old cisco switch

- Moved the FO connection from cisco to FS, controlled the fortilink topology

- Physically moved the cables from cisco to FS, making sure the old switch can be removed

- Removed the old switch

- Health checks for the whole network

 

 

Along the way, I found that one of the transceivers I got from Fortinet was damaged. It would not setup a proper fortilink connection. That cost me a lot of time, especially since fortilink takes a while to sync. 

 

Some things I will remember for the future

- don't forget a small electric screwdriver 

- reserve some time for mundane things like removing tons of dust

- enough drinking water close by

 

Dan

 

 

 

 

3 replies

Anthony_E
Staff
Anthony_E
Staff
June 14, 2024

Hello Dan,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
hbac
Staff
hbac
Staff
June 14, 2024

Hi @dan,

 

• Yes, you can register FortiSwitches serial numbers on FortiCloud.

• You can upgrade FortiSwitches in standalone or from FortiGate. https://community.fortinet.com/t5/FortiSwitch/Technical-Note-Upgrading-FortiSwitch-Firmware/ta-p/197890

• You can check firmware compatibility here https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/d756e8a9-6d2d-11e9-81a4-00505692583a/FortiLinkCompatibility.pdf

• You can use 'Interface migration' feature to move VLANs from LAN1 to fortilink. https://docs.fortinet.com/document/fortigate/7.0.15/administration-guide/885870/interface-migration-wizard

 

Regards,

    dan
    danAuthor
    Explorer II
    June 18, 2024

    Thanks @hbac ,

    I have not been using "Interface migration" so far. But reading the doc seems to indicate that the destination confguration is replaced by the moved configuration. Would I have to re-enable fortilink again on that interface?

     

     

    hbac
    Staff
    hbac
    Staff
    June 18, 2024

    @dan,

     

    fortilink should be enabled by default on fortilink interface. If not, you can enable it. 

     

    Regards,  

      Jeremy5385
      Jeremy5385
      Visitor III
      July 8, 2024

      I've been testing the Interface Migration to accomplish the same migration attempt per the original question and have always been stuck with the wizard being greyed out due to some conflict or dependency in running.  In testing a migration strategy of my own, I was successfully able to set up the new FortiSwitch environment in parallel and an existing Cisco switch environment and bridge together using a trunk port to allow a short window of migration.

       

      The first staging step is to get the FortiSwitch's connected and authorized under FortiLink.  Then create the VLAN(s) under FortiLink without defining an interface IP or DHCP settings.  Then update any firewall policies that included the old interface port by adding the new FortiLink VLAN(s).  Next, cable between a FortiSwitch port and Cisco switch port, making sure both ports pass all VLAN's (this only works if using the same VLAN ID's on both sides of switches or instead set native VLAN on each side if just migrating a single VLAN). Verification is successful when a FortiSwitch port is able to switch through the Cisco switching to the FG. 

       

      The outage part is really just manually removing the interface IP and DHCP settings from the old FG interface connected to the Cisco switches and add it to the FortiLink VLAN interface created earlier. This reverses the switching path so all traffic goes through the FortiLink VLAN interface for routing. 

       

      Cleanup is removing the old Cisco switching interfaces from the firewall polices and zeroing out the old FG interface.  The only downside I have found with this method is the new FortiLink VLAN interface name cannot be the same as the previous interface name due to FG only allowing an interface name once.  Otherwise, this method has tested out fine in a lab migration.  Hope this helps.

        dan
        danAuthorAnswer
        Explorer II
        July 18, 2024

        Thanks for the detailed explanation @Jeremy5385 ,

         

        I actually tried moving with the "Integrate Interface" funktion, but that failed. It said that the task needs to be done manually. It was not such a complex setup after all, so I edited the config file and rebooted with it. No errors. I only had to move the VLAN's unterneath the fortilink adapter. All other configuration was not affected. 

         

        VLAN's were now on fortilink and the LAN1 port was "empty", so no internet for the whole building. I created an interface that provided the needed VLAN's and connected it back to the cisco switch. 

         

        This are the steps I've done:

        - Cleaned up computerroom to get some room to work in (we just took over responsibility)

        - Setup complete FortiSwitch (FS) infrastructure (FO cabling) on a table and connected to the fortigate (FGT). 

        - When I got the topology set up, updated all switches.

        - Made room in the rack for the new switch close to the old switch

        - Mounted the new central FS just above the old cisco switch

        - Mounted the other FS switches in an empty rack just beside the main rack

        - Cabled all switches via fortilink on copper cables, similar to the final setup. 

        - Tested and made sure fortilink topology was ok

        - Prepared a port on the old cisco central switch, connected it with the FS central switch.

        - Moved the VLAN's over to fortilink by editing the config file and rebooted

        - Cisco network did not have internet access, as LAN1 did not hold the VLAN's anymore

        - Checked the FGT configuration, all ok

        - Applied the moved VLAN's to the prepared port on the new FS central switch 

        - Moved the cisco port cabling from LAN1 to the prepared FS port. Cisco network had Internet again.

        - I got me some time now. FO uplinks to other cisco switches remained in place for the time being.

        - Assigned VLAN's to FS ports. I made my work simple by configuring identically to the old cisco switches. 

        - Moved all physical connections from the old cisco central switch to the new FS central switch. - Short interrupts for some end-devices, but it's vacation time in that building and no soul is around. 

        - Now did the same for each other switch the same way.

        - Made room in the rack fort the new FS, close to the old cisco switch

        - Mounted the new FS beneath or above the old cisco switch

        - Moved the FO connection from cisco to FS, controlled the fortilink topology

        - Physically moved the cables from cisco to FS, making sure the old switch can be removed

        - Removed the old switch

        - Health checks for the whole network

         

         

        Along the way, I found that one of the transceivers I got from Fortinet was damaged. It would not setup a proper fortilink connection. That cost me a lot of time, especially since fortilink takes a while to sync. 

         

        Some things I will remember for the future

        - don't forget a small electric screwdriver 

        - reserve some time for mundane things like removing tons of dust

        - enough drinking water close by

         

        Dan

         

         

         

         

        Terms & ConditionsAccessibility statement