Fortiswitch managed by Fortigate, but not connected directly phisycally

[vf]

Dear all,

i want to set up fortiswitch 108F and managed it via Fortigate 201 F. I find this document which explains how achieving it :

https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/173260/configuring-f...

Otherwise, in my case, fortiswicth won't be connected directly to fortigate. Fortiswicth is connected to an uplink switch (which is not Fortinet), itself connected to a fortigate. When i set up this topology, fortiswicth is not detected automatically. Do you know if there is a way to achieve it ? Which vlan do i need to propagate in order to make fortiswitch detected ?

Best regards.

[ebilcari]

Since FGT is not directly connected to a FSW it's better to try the topology FortiLink mode over a layer-3 network and to use In or Out of band management interface for the communication. There is also this article that goes more in details.

[vf]

Thank you for your reply.

In my case , It's a layer 2 domain. There is no routing. I have my fortigate which in interconnected to fortiswitchs through non-fortiswitch devices.  SIf i understand the process to achieve it, i need using ISL links like this :

1. Configure fortilink on fortigate

2. Enable the FortiLink point-to-point network on each FortiSwitch unit

3. Make certain that the FortiLink point-to-point TPID value is the same on each FortiSwitch unit. By default, it is 0x8100.

4. Plugging fortiswicth on level2 domain on auto discovery ports

Is there any mistake ?

Best regards.

[vf]

I don't know how first fortiswicth will be detected if i don't plug directly to fortigate with/without 0-touch management ?

[ebilcari]

I'm not able to test this type of setup but I guess it will not work like this. As I know, Fortilink configuration in FGT will not allow another 3rd party switch in between and allow normal VLAN configuration/spanning like it does when FSW is directly connected. There are two possible topologies: FGT - FSW - 3rd party SW (L2 net) - FSW and FGT - L3 net - FSW . There are also many similar discussions in the forum.

[vf]

Dear all,

Thanks for all your replies. Indeed, IT works. It just requires for equipments (fortigate and fortiswitch)  to have same common fortiswitchs vlan ID. If you want to do zero touch management and configure directly fortiswitch managed, Vlan 1 must be enabled because this is default native vlan for fortilink. The main difficulty is for security issues. According to me, Vlan 1 is a trash vlan where all unconfigured ports send frames. I m gonna test if deploying new Vlan on fortiswitch allows to keep managed by fortigate even if if i delete Vlan 1 after.

[CatInHat]

In order to manage FortiSwitch through FortiGate in your topology, it is important that the routes between FortiGate and FortiSwitch are configured correctly. Check the VLAN and route settings on the FortiGate interface connected to the upstream switch to ensure traffic can pass between devices. Also ensure that the FortiSwitch management VLANs are configured correctly on the upstream switch.