Troubleshooting Tip: FortiSwitch Port Flaps Troubleshooting

[sachitdas_FTNT]

Description	This article provides steps to diagnose the Continuous port flapping on a FortiSwitch.
Scope	FortiSwitch v7.x and above.
Solution	Verify Cable Connection: Ensure the cable is properly connected between the switch port and the end device. Check End Device: Confirm the end device (e.g., PC, AP) is connected to the switch port. Troubleshooting for PC-Connected Ports: Collect Logs: Gather logs from both the switch and the PC: FortiSwitch: exec log filter view-lines 400 exec log filter start-line 1 exec log display PC: Go under Applications and services logs -> Microsoft -> Windows -> Network Profile -> Operational Windows logs -> System The FortiSwitch events logs can also be collected from the FortiAnalyzer, FortiGate and SNMP server. Analyze Logs: Compare the logs to identify the port flap event timing. Example: If both the PC and switch logs show port flaps coinciding with the PC going into sleep mode, the sleep mode might be causing the issue. PC logs: Information 10-07-2024 12:07:44 Kernel-Power 107 (102) --> The system has resumed from sleep. Information 10-07-2024 12:07:43 Kernel-Power 42 (64) --> The system is entering sleep. Sleep Reason: Application API Information 02-07-2024 18:59:43 Kernel-Power 107 (102) --> The system has resumed from sleep. Information 02-07-2024 18:59:43 Kernel-Power 107 (102) --> The system is entering sleep. Sleep Reason: Application API Switch Logs: date="2024-07-10" time="15:37:47" devid="xxx" vd="root" type="event" subtype="switch-controller" bid=4965756 devname="name" dstepid=3 dsteuid=3 dvid=1066 epid=3 euid=3 eventtime=1720593467275583560 id=7389892683369545731 level="notice" logdesc="FortiSwitch link" logid="0115032695" logver=702081639 msg="primary switch port port14 has come up" name="name" sn="name" tz="+0900" user="Fortilink" date="2024-07-10" time="15:37:45" devid="xxx" vd="root" type="event" subtype="switch-controller" bid=4965756 devname="name" dstepid=3 dsteuid=3 dvid=1066 epid=3 euid=3 eventtime=1720593465173236520 id=7389892683369545728 level="notice" logdesc="FortiSwitch link" logid="0115032695" logver=702081639 msg="primary switch port port14 has gone down" name="name" sn="name" tz="+0900" user="Fortilink" date="2024-07-02" time="22:29:46" devid="xxx" vd="root" type="event" subtype="switch-controller" bid=4870234 devname="name" dstepid=3 dsteuid=3 dvid=1066 epid=3 euid=3 eventtime=1719926986332348389 id=7387030164976173103 level="notice" logdesc="FortiSwitch link" logid="0115032695" logver=702081639 msg="primary switch port port14 has come up" name="name" sn="name" tz="+0900" user="Fortilink" date="2024-07-02" time="22:29:44" devid="xxx" vd="root" type="event" subtype="switch-controller" bid=4870234 devname="name" dstepid=3 dsteuid=3 dvid=1066 epid=3 euid=3 eventtime=1719926984158927569 id=7387030164976173100 level="notice" logdesc="FortiSwitch link" logid="0115032695" logver=702081639 msg="primary switch port port14 has gone down" name="name" sn="name" tz="+0900" user="Fortilink" Troubleshooting for AP-Connected Ports: Collect Logs: Gather logs from the AP and compare them with the switch event logs: FortiAP: fap-tech kp Analyze Logs: Compare the logs to identify the port flap event timing. Example: If the AP logs show a crash and the switch logs indicate a port flap, these might be contributing to the port flaps. FortiAP: KERN CRASH LOG 2024-07-23 21:35:30 model=FP431F ver=FAP7.2.040*0409 size=65536 index=6 dt_last=0 Mem Total=891288kB Free=538764kB Bufs=14596kB FortiSwitch: 2024-07-23 21:35:30 log_id=0100001401 type=event subtype=link pri=notice vd=root action="port-down" user="ctrld" unit="primary" switch.physical-port="port3" status="down" msg="primary switch port port3 has gone down" By following these steps and carefully analyzing the logs, it is possible to troubleshoot and resolve FortiSwitch port flap issues.