Skip to main content
Consensus
Consensus
Explorer II
March 16, 2022
Solved

How do I delete VLAN Switch/delete the configuration/get the configuration back to standard?

  • March 16, 2022
  • 4 replies
  • 34178 views

Brand new FortiGate 60F.

 

For some reason, instead of a Hardware Switch it has a VLAN Switch (Network >> Interfaces).

 

I'd much rather have it have a Hardware Switch, like the other FortiGate Firewalls we administer, but how do I change it/delete it?

 

I've tried factoryreset and factoryreset2, but it has survived :(

 

So how do I delete the VLAN Switch, change it to a Hardware Switch? I'm ready to wipe the configuration and start from scratch.

 

The FortiGate is running FortiOS 6.4.8.

 

Thanks!

    Best answer by Toshi_Esumi

    Ok, I think I found the direct answer to Concensus.

     

    config system global

      set virtual-switch-vlan disable

    end

     

    This would change the GUI to show "Hardswitch". And you'll get a warning below:

     

    labtest60f-1 (global) # set virtual-switch-vlan dis
    This change will disable trunk on interfaces and remove VLAN from virtual switches.
    If you don't want it to be changed, type "abort"

     

    I need to test further but based on the description for 300E below, it appears that if you enabled this (it's enabled by default at least 6.4.8 on FG60F) you can create virtual switch interfaces per VLAN, like port 1-2-3 for VLAN10, port 2-3-4 for VLAN20, which simple hard-switch can't do. I still don't know what "set trunk enble" on each interface would do.

     

    https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/183531/virtual-switch-support-for-fortigate-300e-series

     

    Toshi

    4 replies

    Consensus
    ConsensusAuthor
    Explorer II
    March 16, 2022

    OK, checked with another brand new FortiGate 60F: Looks like it's 'born' with VLAN. So, reverting the configuration probably won't help.

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      March 16, 2022

      Can you share the screen? Probably none of us understand what you're talking about.

       

      Toshi

        Consensus
        ConsensusAuthor
        Explorer II
        March 17, 2022

        Thanks for replying.

         

        I hope this helps:

        image.png

         

        Consensus
        ConsensusAuthor
        Explorer II
        March 17, 2022

        I've tried this:

        I loaded at configuration from the Other FortiGate 60F and I'm back to Hardware Switch.


        I then reset the FortiGate and the VLAN Switch is back :(

        The logical conclusion must be (?) that the VLAN Configuration is part of the new firmware? Then why don't I have it on the other Firewall? They both run same version of FortiOS!

        AlexC-FTNT
        Staff
        AlexC-FTNT
        Staff
        March 17, 2022

        you are correct here. Vlan switch is the default configuration in newer firmware

          Toshi_Esumi
          SuperUser
          Toshi_Esumi
          SuperUser
          March 17, 2022

          I didn't know this until now either because I almost never use GUI for our LAB 60F. But despite what the GUI shows after a factoryrest, the actual config in CLI is still hard-switch (config system virtual-switch) as below. Then only when we upgraded from older version of FortiOS like 6.2, does the GUI stay with "Hardswitch"? We upgraded this 60F from 6.2.10 to 6.4.8 a while ago but it had "Hardswitch" in GUI like Consensus showed then changed it after the factory reset.

          Is this just "cosmetic" change in GUI?

           

          config system interface
          edit "internal"
          set vdom "root"
          set ip 192.168.1.99 255.255.255.0
          set allowaccess ping https ssh fgfm fabric
          set type hard-switch
          set stp enable
          set role lan
          set snmp-index 13
          next
          end

           

          config system virtual-switch
          edit "internal"
          set physical-switch "sw0"
          config port
          edit "internal1"
          next
          edit "internal2"
          next
          edit "internal3"
          next
          edit "internal4"
          next
          edit "internal5"
          next
          end
          next
          end

           

          Toshi

           

            Toshi_Esumi
            SuperUser
            Toshi_EsumiAnswer
            SuperUser
            March 17, 2022

            Ok, I think I found the direct answer to Concensus.

             

            config system global

              set virtual-switch-vlan disable

            end

             

            This would change the GUI to show "Hardswitch". And you'll get a warning below:

             

            labtest60f-1 (global) # set virtual-switch-vlan dis
            This change will disable trunk on interfaces and remove VLAN from virtual switches.
            If you don't want it to be changed, type "abort"

             

            I need to test further but based on the description for 300E below, it appears that if you enabled this (it's enabled by default at least 6.4.8 on FG60F) you can create virtual switch interfaces per VLAN, like port 1-2-3 for VLAN10, port 2-3-4 for VLAN20, which simple hard-switch can't do. I still don't know what "set trunk enble" on each interface would do.

             

            https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/183531/virtual-switch-support-for-fortigate-300e-series

             

            Toshi

              Toshi_Esumi
              SuperUser
              Toshi_Esumi
              SuperUser
              March 17, 2022

              If vlan-switch interface is created under virtual-switch like in the document, then I tried to enable "trunk" on one of interface I bet below error. The config seems to have gone through though.

               

              NP6XLITE: VS member add fails: vlif already in vs 82

               

              And I don't seem to be able to stack or overlap multiple vlans on one interface in the virtual-switch. If you enabled "trunk" that interface doesn't show up as an candidate for a new vlan-switch interface.

               

              There need to be a comprehensive document for "Virtual-switch VLAN" and "trunk" including what are these for somewhere. Please somebody point us to a proper doc.

               

              Toshi

                Terms & ConditionsAccessibility statement