FortiManager with Fortiswitch VLAN template overriding Fortigate Interface properties

[dujardind]

Hello everybody,

We are using FortiManager 7.2 to manage FortiGate and FortiSwitch

Central-Management of switches is enabled with template.

In the FortiSwitch template, we use vlan object, in order to assign vlan to the ports of the switchs.

But we note than the vlan template object will override all the interface configuration in the Fortigate.

In our case, we are looking for a solution that does not impact the DHCP server on the interface.

For example, all our DHCP reservation (defined per Fortigate) are purged when installing the template...

Is there a mean to prevent interface modification on the Fortigate, and so just use VLAN object of Fortiswitch manager to assign vlan to fortiswitch ports ?

Best Regards

[smkml]

Hello @dujardind ,

Have you tried to import the switch template first before make any change on FortiSwitch Manager?

 

[dujardind]

Hello @smkml ,

In fact, we have a lot of Fortigate (and Fortiswitch) with the same template.

Each of them use the same template, including vlan name and tag.

We just have some IP set by CLI template and specific DHCP Reservation directly registered in the device database, different for each Fortigate.

So we don't want than the vlan template object be applied (as interface on Fortigate) each time a device installation is pushed from FortiManager.

[smkml]

Hi @dujardind ,

Since you make the changes on device database, I would suggest that you disabled the FortiSwitch central-management.

If central-management are enabled, your vlan related configuration need to change on the FortiSwitch Manager itself. Which is why it tried to purge your DHCP reservation config because the changes are in device database level. 

 

 

[dujardind]

Thanks for your reply @smkml

We realy need central management by template because we have hundreds of switches to configure. It's not a good idea to do that without central templating..

I'm trying to find a workaround for DHCP in 3 steps

1- Reaffect my DHCP Server to another interface

2- Apply VLAN template from Fortiswitch without DHCP Server

3- Reaffect DHCP Server to the original interface (same as VLAN template)

I find a way to to the third step with the CLI template, that is applied after the Fortiswitch template.

But, for the first step, I'm looking for a way to apply another CLI template or any other script before the Fortiswitch template

I hope somebody have an idea about that

[smkml]

Hi @dujardind ,

Then, I would suggest that you make the changes on the FortiSwitch Template itself to reflect on ADOM level instead of device database level.

Another option is, to use a Script instead of CLI template to run it one time to multiple devices.

You may check below document for various example for the CLI scripts:

https://docs.fortinet.com/document/fortimanager/7.2.4/administration-guide/71780/cli-scripts