Ferritaas Incident Intelligence
Defect Intelligence Report Bug 0861092 Severity: High (Switch Fabric Isolation)

FortiLink ISL Trunk Auto-Negotiation Failure After Switch Firmware Reboot

Inter-switch link (ISL) trunks between managed FortiSwitches fail to reform dynamic LACP link aggregation bundles following a core switch firmware upgrade or power cycle, leaving downstream access layer switches and connected APs completely isolated.

🚀 Open Full Runbook & Live Automation on Ferrite → Browse Known Issues Directory
⏱️ Est. Triage: 6–8 mins | Automated CLI Available

Technical Root Cause Analysis

In Security Fabric deployments using FortiLink, the FortiGate acts as a centralized switch controller. Tier-1 distribution switches establish FortiLink connections, while Tier-2 and Tier-3 access switches connect via auto-discovered Inter-Switch Links (ISL) using custom Fortinet LLDP TLVs and dynamic 802.3ad LACP trunks.

Following a firmware reboot on a core FortiSwitch, physical link detection on high-speed fiber interfaces (SFP28/QSFP28) comes up before the switch's internal controller stack completes initialization. The FortiGate controller's LLDP discovery timer times out after 45 seconds and halts negotiation. Consequently, the switch ports remain in an unbundled individual state and STP blocks the interfaces, isolating the downstream stack.

Affected Firmware & Blast Radius Matrix

FortiOS Branch Vulnerable Builds Confirmed Clean Build Status & Workaround
FortiOS 7.2 7.2.0 – 7.2.5 7.2.6+ Lock static trunk / bounce aggregate
FortiOS 7.4 7.4.0 – 7.4.1 7.4.2+ Extended 180s discovery timer patch
FortiOS 7.0 Low Occurrence 7.0.12+ Older LLDP state machine timing differs

Platform Impact: Enterprise multi-tier FortiSwitch fabrics managed via FortiGate FortiLink (FS-100 series up to FS-1000 series).

Step 01: Free Verification CLI (Safe Read-Only)

Execute these commands to inspect discovered ISL trunks, LACP bundle state, and managed switch connectivity:

Diagnostic Commands

# 1. Inspect active FortiLink ISL trunk discovery tables
diagnose switch-controller dump isl

# 2. Check client load balancing and trunk hash state
diagnose switch-controller dump switch-clb

# 3. Dump low-level switch trunk and member port statistics
diagnose switch-controller switch-info trunk

# 4. Check managed switch status and software versions
get switch-controller managed-switch

Remediation & Workaround Steps (Teaser Preview)

Access the complete non-disruptive switch fabric recovery guide in the Ferrite interactive platform:

Step 02: Surgical Aggregate Interface Toggle

Re-trigger LACP discovery without physical site dispatch by bouncing the FortiLink aggregate member.

🔒 Interactive CLI Available in Ferrite Runbook #22

Step 03: Lock Static ISL Trunk Definition

Convert auto-isl to static trunk in switch-controller trunk to eliminate LLDP discovery race conditions.

🔒 Interactive CLI Available in Ferrite Runbook #22

Step 04: Align LACP Rate to Fast Timers (1-Second Heartbeat)

Configure set lacp-speed fast on FortiLink trunks to guarantee rapid sub-second convergence.

🔒 Interactive CLI Available in Ferrite Runbook #22
⚡ Ferrite Platform Superpowers

Execute Runbook #22 with Live Browser Automation

Connect your FortiGate via browser console (Web Serial) or local SSH bridge, verify each command in real-time, generate ready-to-run Tera Term scripts, and export sanitized TAC dossiers.

⚡
Live Browser Automation Direct terminal connection with live step checkoff.
📟
1-Click Tera Term (.ttl) Generate scripts for air-gapped jumpboxes.
🛡️
Zero-Trust Scrubber Scrub serials and credentials in local browser RAM.
📄
TAC P1 Escalation Dossier Standardized evidence export with SHA-256 seal.

Frequently Asked Questions

What causes Bug 0861092?

Timing discrepancies between PHY optical link-up and switch controller daemon initialization cause dynamic LLDP discovery to time out after switch reboots.

Can the trunk be restored remotely?

Yes. Toggling the FortiLink aggregate interface via CLI forces a fresh discovery cycle and recovers isolated access switches.

Which firmware releases contain the fix?

FortiOS 7.2.6 and 7.4.2 increased LLDP discovery tolerance to 180 seconds and added automatic trunk renegotiation retries.