Brand new FortiGate 60F.
For some reason, instead of a Hardware Switch it has a VLAN Switch (Network >> Interfaces).
I'd much rather have it have a Hardware Switch, like the other FortiGate Firewalls we administer, but how do I change it/delete it?
I've tried factoryreset and factoryreset2, but it has survived :(
So how do I delete the VLAN Switch, change it to a Hardware Switch? I'm ready to wipe the configuration and start from scratch.
The FortiGate is running FortiOS 6.4.8.
Thanks!
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Ok, I think I found the direct answer to Concensus.
config system global
set virtual-switch-vlan disable
end
This would change the GUI to show "Hardswitch". And you'll get a warning below:
labtest60f-1 (global) # set virtual-switch-vlan dis
This change will disable trunk on interfaces and remove VLAN from virtual switches.
If you don't want it to be changed, type "abort"
I need to test further but based on the description for 300E below, it appears that if you enabled this (it's enabled by default at least 6.4.8 on FG60F) you can create virtual switch interfaces per VLAN, like port 1-2-3 for VLAN10, port 2-3-4 for VLAN20, which simple hard-switch can't do. I still don't know what "set trunk enble" on each interface would do.
Toshi
OK, checked with another brand new FortiGate 60F: Looks like it's 'born' with VLAN. So, reverting the configuration probably won't help.
Can you share the screen? Probably none of us understand what you're talking about.
Toshi
Thanks for replying.
I hope this helps:
I've tried this:
I loaded at configuration from the Other FortiGate 60F and I'm back to Hardware Switch.
I then reset the FortiGate and the VLAN Switch is back :(
The logical conclusion must be (?) that the VLAN Configuration is part of the new firmware? Then why don't I have it on the other Firewall? They both run same version of FortiOS!
you are correct here. Vlan switch is the default configuration in newer firmware
Created on 03-17-2022 11:06 AM Edited on 03-17-2022 11:12 AM
I didn't know this until now either because I almost never use GUI for our LAB 60F. But despite what the GUI shows after a factoryrest, the actual config in CLI is still hard-switch (config system virtual-switch) as below. Then only when we upgraded from older version of FortiOS like 6.2, does the GUI stay with "Hardswitch"? We upgraded this 60F from 6.2.10 to 6.4.8 a while ago but it had "Hardswitch" in GUI like Consensus showed then changed it after the factory reset.
Is this just "cosmetic" change in GUI?
config system interface
edit "internal"
set vdom "root"
set ip 192.168.1.99 255.255.255.0
set allowaccess ping https ssh fgfm fabric
set type hard-switch
set stp enable
set role lan
set snmp-index 13
next
end
config system virtual-switch
edit "internal"
set physical-switch "sw0"
config port
edit "internal1"
next
edit "internal2"
next
edit "internal3"
next
edit "internal4"
next
edit "internal5"
next
end
next
end
Toshi
Ok, I think I found the direct answer to Concensus.
config system global
set virtual-switch-vlan disable
end
This would change the GUI to show "Hardswitch". And you'll get a warning below:
labtest60f-1 (global) # set virtual-switch-vlan dis
This change will disable trunk on interfaces and remove VLAN from virtual switches.
If you don't want it to be changed, type "abort"
I need to test further but based on the description for 300E below, it appears that if you enabled this (it's enabled by default at least 6.4.8 on FG60F) you can create virtual switch interfaces per VLAN, like port 1-2-3 for VLAN10, port 2-3-4 for VLAN20, which simple hard-switch can't do. I still don't know what "set trunk enble" on each interface would do.
Toshi
Created on 03-17-2022 04:01 PM Edited on 03-18-2022 10:00 AM
If vlan-switch interface is created under virtual-switch like in the document, then I tried to enable "trunk" on one of interface I bet below error. The config seems to have gone through though.
NP6XLITE: VS member add fails: vlif already in vs 82
And I don't seem to be able to stack or overlap multiple vlans on one interface in the virtual-switch. If you enabled "trunk" that interface doesn't show up as an candidate for a new vlan-switch interface.
There need to be a comprehensive document for "Virtual-switch VLAN" and "trunk" including what are these for somewhere. Please somebody point us to a proper doc.
Toshi
You are the Man!
This solved it on the FortiGate 60F too.
Thank you so much :)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.