Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
vf
New Contributor II

Fortiswitch managed by Fortigate, but not connected directly phisycally

Dear all,

 

i want to set up fortiswitch 108F and managed it via Fortigate 201 F. I find this document which explains how achieving it :

https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/173260/configuring-f...

Otherwise, in my case, fortiswicth won't be connected directly to fortigate. Fortiswicth is connected to an uplink switch (which is not Fortinet), itself connected to a fortigate. When i set up this topology, fortiswicth is not detected automatically. Do you know if there is a way to achieve it ? Which vlan do i need to propagate in order to make fortiswitch detected ?

 

Best regards.

6 REPLIES 6
ebilcari
Staff
Staff

Since FGT is not directly connected to a FSW it's better to try the topology FortiLink mode over a layer-3 network and to use In or Out of band management interface for the communication. There is also this article that goes more in details.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
vf
New Contributor II

Thank you for your reply.

In my case , It's a layer 2 domain. There is no routing. I have my fortigate which in interconnected to fortiswitchs through non-fortiswitch devices.  SIf i understand the process to achieve it, i need using ISL links like this :

1. Configure fortilink on fortigate

2. Enable the FortiLink point-to-point network on each FortiSwitch unit

3. Make certain that the FortiLink point-to-point TPID value is the same on each FortiSwitch unit. By default, it is 0x8100.

4. Plugging fortiswicth on level2 domain on auto discovery ports

 

Is there any mistake ?

 

Best regards.

 

vf
New Contributor II

I don't know how first fortiswicth will be detected if i don't plug directly to fortigate with/without 0-touch management ?

ebilcari

I'm not able to test this type of setup but I guess it will not work like this. As I know, Fortilink configuration in FGT will not allow another 3rd party switch in between and allow normal VLAN configuration/spanning like it does when FSW is directly connected. There are two possible topologies: FGT - FSW - 3rd party SW (L2 net) - FSW and FGT - L3 net - FSW . There are also many similar discussions in the forum.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
vf
New Contributor II

Dear all,

Thanks for all your replies. Indeed, IT works. It just requires for equipments (fortigate and fortiswitch)  to have same common fortiswitchs vlan ID. If you want to do zero touch management and configure directly fortiswitch managed, Vlan 1 must be enabled because this is default native vlan for fortilink. The main difficulty is for security issues. According to me, Vlan 1 is a trash vlan where all unconfigured ports send frames. I m gonna test if deploying new Vlan on fortiswitch allows to keep managed by fortigate even if if i delete Vlan 1 after.

CatInHat
New Contributor III

In order to manage FortiSwitch through FortiGate in your topology, it is important that the routes between FortiGate and FortiSwitch are configured correctly. Check the VLAN and route settings on the FortiGate interface connected to the upstream switch to ensure traffic can pass between devices. Also ensure that the FortiSwitch management VLANs are configured correctly on the upstream switch.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors