Technical Tip: How to stop FortiLink discovery between two FortiSwitches managed by two different FortiGates

[ap]

Description	This article describes how to stop FortiLink discovery between two FortiSwitches which are managed by two separate FortiGate firewalls. So that, only specific FortiSwitches show up under managed FortiSwitches on their respective FortiGate.
Scope	FortiGate, FortiSwitch.
Solution	Note: This Article applies only when Fortiswitch-A and Fortiswitch-B are getting connected for the first time. If there is already a FortiLink established between these two FortiSwitches, it does not apply. Reach out to Fortinet Technical Support by creating a support ticket. As these changes are done locally on FortiSwitches, a Factory reset of Fortiswitch-A or Fortiswitch-B can remove these changes. Precaution should be taken before adding these switches back to the network and connecting them again. Use the above topology for reference where Fortigate-A and Fortigate-B are managing several FortiSwitches. The last managed switch by Fortigate-A and Fortigate-B will be Fortiswitch-A and Fortiswitch-B respectively. Ensure that only switches up to Fortiswitch-A show up under managed switches on Fortigate-A and similarly, only switches up to Fortiswitch-B should be shown under managed switches by Fortigate-B. Port28 on Fortiswitch-A is connected with port17 on FortiSwitch. This link connects two different sites. Refer to the below steps on how to identify and change the LLDP profile assigned to a particular FortiSwitch port from FortiGate GUI and FortiGate CLI. FortiGate GUI: Navigate under WiFi & Switch Controller -> FortiSwitch Ports: By default, the LLDP Profile column is hidden. To enable it, hover the mouse over the topmost column titles and select the grey gear icon that appears. Select and enable LLDP Profile. Navigate to the specific FortiSwitch and its port on which it is desired to change the LLDP profile. Check LLDP profile on the FortiSwitch ports (port28 of Fortiswitch-A and port17 of Fortiswitch-B) on the respective FortiGate GUI. Edit the LLDP profile column here and set it to the required LLDP profile for a particular port. FortiGate CLI: FGT # config switch-controller managed-switch FGT (managed-switch) # edit <preexisting-switch-serial-number> FGT (S224ABCD00000001) # config ports FGT (ports) # edit <port#-that-connects-NEW-switch> FGT (port1) # set lldp-profile default-auto-isl FGT (port1) # end FGT (S224ABCD00000001) # end Check auto-isl status on the LLDP profile from the FortiGate CLI of both FortiGates. By default, the 'default' LLDP profile will have auto-isl disabled, and 'default-auto-isl' profile has it enabled. Use the LLDP profile with auto-isl disabled (Here, it is the 'default' LLDP profile). In this case, change the LLDP profile on port28 of Fortiswitch-A and port17 of Fortiswitch-B to the 'default' LLDP profile. (it is possible to use either CLI or GUI for changing the LLDP profile as illustrated in the above steps). Once the LLDP profile is changed, check the managed FortiSwitches under FortiGate GUI and it will show only FortiSwitches which are managed by the respective FortiGate. It will only show FortiSwitches up to Fortiswitch-A under Fortigate-A GUI and only up to Fortiswitch-B for Fortigate-B GUI.