NSE6 Part 5: FortiSwitch Hardware, FortiLink Managed Mode, and Initial Provisioning

9 June 2026 NSE6Fortinet

FortiSwitch is Fortinet’s managed-access-layer switching product. Unlike a traditional standalone switch where you configure everything locally, the design intent for FortiSwitch in most deployments is FortiLink managed mode — the FortiGate acts as a centralised wireless-LAN-controller-style manager for all connected switches, and configuration is pushed from the FortiGate GUI or CLI rather than configured switch-by-switch.

The FCA-FSW exam starts here: know the hardware families, understand what FortiLink is and why it exists, and be able to provision a switch from scratch.

FortiSwitch Hardware Families

Fortinet organises FortiSwitch into product lines by port density, uplink speed, and PoE capability:

100 Series — Entry access

  • FS-108F / 108F-POE / 108F-FPOE — 8 × 1G access ports, 2 × 10G SFP+ uplinks. FPOE = full PoE budget on all ports.
  • FS-124F / 148F — 24/48 × 1G access, 4 × 10G SFP+ uplinks.
  • Target: small branch, SMB.

200 Series — Mid access

  • FS-224E / 224E-POE / 224E-FPOE — 24 × 1G, 4 × 10G SFP+ uplinks.
  • FS-248E — 48 × 1G access, 4 × 10G + 2 × 40G uplinks.
  • Target: medium branch, wiring closet.

400 Series — High-density PoE / enterprise access

  • FS-448E-FPOE — 48 × 1G PoE+ ports, 4 × 25G SFP28, 2 × 40G QSFP+ uplinks.
  • Target: enterprise campus access with high-density PoE (IP phones, FortiAP).

500/600 Series — Aggregation / 10G access

  • FS-524D — 24 × 10G SFP+ access/uplinks, 2 × 40G QSFP+.
  • FS-548D — 48 × 10G.
  • Target: aggregation, ToR in data centre.

Key hardware specs for the exam

SpecWhy it matters
PoE budget (Watts)Total wattage available to connected PoE devices. 802.3af = 15.4W per port; 802.3at (PoE+) = 30W per port. A 124F-POE might have 185W total — divide by 30W and you get ~6 fully-loaded PoE+ ports before the budget is exhausted.
Uplink type1G RJ45 uplinks are fine for small installs; 10G SFP+ or 25G SFP28 are needed for high-density AP or server-access deployments.
StackingSome 500-series models support physical stacking (backplane connection) for high-density aggregation. Managed-mode deployments more commonly use MCLAG for resilience — covered in Part 6.

Standalone mode is how a FortiSwitch behaves out of the box if you don’t connect it to a FortiGate with FortiLink. You configure it directly via console, SSH, or a management IP on VLAN 1. All commands go directly to the switch.

When to use standalone: isolated networks, non-Fortinet environments, lab work where you want to test switch-only features.

FortiLink managed mode is the target state for any FortiSwitch in a Fortinet deployment. The switch hands control of its VLAN and port configuration to the FortiGate. The key changes:

  • The FortiGate GUI shows all managed switches under Network > Interfaces > FortiSwitch
  • VLAN, port profile, 802.1X, and firmware config all come from FortiGate
  • The switch’s own management interface is still accessible for emergency console access, but normal config changes go through FortiGate

You cannot do both at once. A switch in FortiLink managed mode ignores locally applied config changes (they are overwritten by the controller on next sync).

FortiLink is a proprietary control channel that runs over a dedicated VLAN (VLAN 4094 by default). It carries:

  • Discovery and keepalive messages
  • Configuration push (switch VLANs, port assignments, security policies, firmware updates)
  • Status and telemetry pull (port state, MAC table, STP state, PoE status)

FortiLink uses the Link-State Discovery Protocol between FortiGate and FortiSwitch. The FortiGate learns about connected switches via FortiLink advertisements on VLAN 4094, then authorises them to come under management.

The FortiLink interface on FortiGate is a logical interface of type fortilink. Physical ports (or a LAG) are assigned to this interface. Traffic on those ports is dedicated to FortiLink — they do not carry normal data plane traffic.

config system interface
  edit "fortilink"
    set type fortilink
    set fortilink-stacking disable
  next
end

config system virtual-switch
  # Assign a physical port to the fortilink interface
  edit "fortilink"
    set physical-switch "sw0"
    config port
      edit "port3"
      next
    end
  next
end

Or via GUI: Network > Interfaces > Create New > Type: FortiLink and assign a physical port.

A LAG (802.3ad) FortiLink uses two physical ports bonded together. If one uplink from FortiSwitch to FortiGate fails, FortiLink continues on the surviving port.

Two FortiGates in HA pair with an MCLAG FortiLink — the switch connects to both FortiGates on a LAG. Covered in Part 6 under MCLAG.

FortiSwitch Discovery and Authorisation

Discovery sequence

  1. FortiSwitch is factory-reset and powered on.
  2. Switch sends FortiLink discovery frames (using LLDP) on all ports.
  3. FortiGate receives the discovery frames on the FortiLink interface.
  4. FortiGate lists the switch in Network > FortiSwitch > Managed Switches with status Discovered (or Waiting for Authorisation depending on firmware).

Manual authorisation (default)

By default, FortiGate does not automatically trust new switches. An admin must explicitly authorise each one:

GUI: Network > FortiSwitch > Managed Switches > [switch serial] > Authorize

CLI:

config switch-controller managed-switch
  edit "S524DF4K15000024"
    set fsw-wan1-admin enable
    set fsw-wan1-peer "fortilink"
  next
end

Auto-authorisation (convenience, less secure)

config switch-controller global
  set auto-scan-stp-root enable
  # or
  set switch-management-mode local
end

With auto-authorisation enabled, any FortiSwitch that connects to the FortiLink interface is automatically authorised. Useful in a lab; not recommended in production (a rogue switch could be authorised accidentally).

After authorisation

  • FortiGate pushes the base configuration to the switch (management VLAN, NTP, DNS).
  • The switch appears in Network > FortiSwitch > Managed Switches with a green status indicator.
  • Port profiles, VLANs, and security policies can now be pushed.

Once under FortiLink management:

  • In-band management uses the FortiLink management IP that FortiGate assigns.
  • FortiGate assigns the switch a management VLAN (configurable under the switch’s managed-switch settings).
  • The switch’s original VLAN 1 management IP is no longer used for routine admin.

For out-of-band access (emergency recovery):

# On the FortiSwitch console (standalone fallback):
show switch management

Firmware Management

FortiGate manages FortiSwitch firmware upgrades:

System > Firmware > FortiSwitch

Or:

execute switch-controller switch-software upgrade S524DF4K15000024 <image-filename>

Version matching: FortiSwitch firmware must be compatible with the FortiOS version on the FortiGate. The compatibility matrix is published in the FortiSwitch release notes. Mismatches cause the FortiLink channel to stay connected but configuration pushes may fail silently.

Upgrade order for HA: In a FortiGate HA pair with MCLAG FortiLink, upgrade FortiOS on the secondary FortiGate first, failover, then upgrade the primary. This avoids a scenario where the primary is on incompatible firmware while the switches are already upgraded.

Key Diagnostic Commands

# Show all managed switches and their FortiLink connection status
execute switch-controller get-conn-status

# Show port-level statistics for a specific switch
diagnose switch-controller switch-info port-stats <serial>

# Show STP state
diagnose switch-controller switch-info stp-instance <serial>

# Show MAC address table
diagnose switch-controller switch-info mac-table <serial>

# Force a re-scan of a switch (if config push seems stuck)
execute switch-controller restart-dhcpd <serial>

# Check FortiLink uplink from FortiSwitch side (on switch console)
show switch fortilink

Common Exam Scenarios

Q: A FortiSwitch appears as “Discovered” but cannot be authorised. A: Check that the FortiGate port assigned to the FortiLink interface is actually connected to the switch. Also check that the switch is running a firmware version compatible with the FortiOS version. VLAN 4094 must not be blocked anywhere between them.

Q: After authorising a switch, the FortiGate shows it as “Connected” but no configuration is pushed. A: Run execute switch-controller get-conn-status and check the Config Sync field. If it shows Failed, check the shared SNMP community string or FortiLink VLAN config. Firmware mismatch is also a common cause.

Q: A FortiSwitch was previously standalone-mode and has a custom VLAN config. After connecting to FortiLink it loses all its VLANs. A: Expected behaviour. FortiLink managed mode overwrites the local configuration. Back up any standalone config before connecting to FortiLink.