Skip to main content
Toshi_Esumi
SuperUser
SuperUser
April 6, 2023
Solved

Starting over FortiSwitch configuration at FortiGate

  • April 6, 2023
  • 4 replies
  • 4590 views

I can't easily find this part of FGT-Managed FSW operation in the guid books or somewhere else. So I decided to post this.

 

I was trying to figure out how to duplicate Cisco CBS switch's default QoS behaviors with FSWs and looked like I messed up config probably because I was touching both FGT and FSW config via console. So I decided to start over from scratch. Then encountered some difficulty because a simple Factory reset of those managed switches via GUI doesn't erase whatever configured under "config switch-controller". Especially under "config switch-controller managed-switch".

 

Even when I "Delete" each FSW at WiFi&Switch Controller->Managed FortiSwitches in GUI, the config under "config switch-controller managed-switch" stays there. And maybe because of that, I don't seem to be able to re-register/re-authorize the FSWs. In this situation, do I have to go in CLI and delete all of them one by one (or just "purge")?

Or, is there a simple button to erase all FSW related config without factory-resetting the entire FGT config?

Thanks,

 

Toshi

Best answer by Toshi_Esumi

After further testing, I opened a ticket at TAC and I got the answer to my original question. It's not a single button but a 2-step operation.
To erase what the FGT has learned and start over an FSW activation in GUI after factoryreseting the FSW is:
1) "Deauthorize" the FSW in the context menu, which would cause it to disappear from the "List" view.

2) Switch to "Topology" view and "Delete" the FSW in the context menu.

 

Toshi

4 replies

gfleming
Staff
Staff
April 8, 2023

Good question. You probably have to delete from the CLI on the FortiGate.

 

Not sure if it makes any diffence, did you do factory reset from the FortiGate or the FortiSwitch console?

https://docs.fortinet.com/document/fortiswitch/7.2.4/fortilink-guide/173266/discovering-authorizing-and-deauthorizing-fortiswitch-units#Deauthor

Toshi_Esumi
SuperUser
SuperUser
April 8, 2023

I did that FSW factory reset first then realized it didn't cause it to disappear from the managed FSW view in GUI. That's why I asked.
But at the same time I decided to upgrade all FSWs from 7.0.6 to 7.2.4 based on TAC's recommendation through a QoS config ticket, so I ended up factoryresetting the FGT as well, and am starting over on both FGT and FSWs now.

This is just a test environment so I need to figure out how to do this in real existing FGT customer situations before we start installing FSWs to them.

 

For now I don't have the situation any more. Thank you for responding to me.

 

Toshi

Toshi_Esumi
SuperUser
Toshi_EsumiAuthorAnswer
SuperUser
April 11, 2023

After further testing, I opened a ticket at TAC and I got the answer to my original question. It's not a single button but a 2-step operation.
To erase what the FGT has learned and start over an FSW activation in GUI after factoryreseting the FSW is:
1) "Deauthorize" the FSW in the context menu, which would cause it to disappear from the "List" view.

2) Switch to "Topology" view and "Delete" the FSW in the context menu.

 

Toshi

Toshi_Esumi
SuperUser
SuperUser
April 11, 2023

Same can be done in CLI:

config switch-controller managed-switch
edit <Serial_Number>
set fsw-wan1-admin disable
end
config switch-controller managed-switch
del <Serial_Number>

end

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.