How to configure the management port of a FortiSwitch managed by a FortiGate firewall via a FortiLink interface

When you install some fortiswitches wich are managed by a fortigate firewall, management is done via the web interface of the fortigate. When you have to do some configuration wich is not available in the gui, you have to use a ssh session from the fortigate unit to the FortiLink ip address of the FortiSwitch. This is very cumberstone. You cannot copy configuration templates to the switch. It even means there is no SNMP path to your fortiswitch wich makes it impossible to monitor the unit by i.a. PRTG.

If you want to manage a FortiSwitch bypassing the FortiLink interface you have to connect the management port to a management vlan. Remember that you always have to manage the FortiSwitch by the webinterface of the Fortigate exept for the configuration wich is only possible on the FortiSwitch itsef.

fortiswitch lacp trunk cisco switch

The first step is to login to the fortigate and find the ip address of the fortiswitch you want to manage. Click on the fortiswitch you want to manage. The ip address is displayed in the next window.

fortiswitch lacp trunk cisco switch

Now connect to the fortigate firewall cli. You can connect from the fortigate via ssh to the connected fortiswitch. use the following command

execute ssh admin@169.254.1.2

fortiswitch lacp trunk cisco switch cli

Replace the ip address by the ip address previously noted. The default password is empty. Remember to change the default password of the fortiswitch immediately after connecting the management interface!

When you are connected to the fortiswitch you can assign a ip address to the management interface of the FortiSwitch. This is done by the following commands:

config system interface
  edit "mgmt"
    set ip 10.1.1.1 255.255.255.0
    set allowaccess ping https http ssh telnet snmp
    set type physical
    set snmp-index 54
  next
end

DSMR P1 – Slimme meter via WiFi adapter met display

Now you have to enter a default gateway for the switch to the rest of the network.

config router static
  edit 1
    set device "mgmt"
    set dst 10.0.0.0 255.0.0.0
    set gateway 10.1.1.254
  next
end

Now connect the management interface of the FortiSwitch to the management vlan of your network. When this is done you can access the switch on ip basis and monitor it with the program of choice.

fortiswitch lacp trunk cisco switch

2 thoughts on “How to configure the management port of a FortiSwitch managed by a FortiGate firewall via a FortiLink interface”
  1. Hi,
    Thank you for this article! What do you mean with “If you want to manage a FortiSwitch bypassing the FortiLink interface you have to connect the management port to a management vlan”

    Connect it physically? I have some switches connected to the fortigate connected only via fortilink, and the switches have got IP Adresses (169…) from the fortilink. for me its now not clear how to change this.

    thanks
    Andreas

Leave a Reply

Your email address will not be published. Required fields are marked *