FortiSwitch Managed Ports Stuck in 'Discovering' State over FortiLink
FortiSwitch units connected across FortiLink trunks become unresponsive to configuration sync and remain perpetually stuck in Discovering or Authorizing state due to STP BPDU Guard drops on native VLAN 4094.
Technical Root Cause Analysis
FortiGate manages downstream FortiSwitch hardware through the FortiLink protocol, which operates an encapsulation tunnel running CAPWAP control messages (UDP 5246 and 4014) over a dedicated internal management network tagged as native VLAN 4094. Concurrently, FortiOS runs Spanning Tree Protocol (STP/RSTP) across FortiLink to guard against forwarding loops on redundant aggregate links and inter-switch links (ISLs).
In affected FortiOS and FortiSwitchOS builds, when global STP BPDU Guard or edge-port defaults are configured on switch uplinks, the FortiSwitch detects incoming BPDUs from the FortiGate management plane as an STP anomaly. The switch port enters an err-disable or soft-block condition for VLAN 4094. While lower-level physical Ethernet link status reports UP, all CAPWAP discovery, echo, and HTTPS REST sync requests are discarded by the switch ingress filter, stranding the switch controller in an unresolved discovery loop.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.4 – 7.2.7 | 7.2.8+ | Disable BPDU Guard on FortiLink member ports |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Upgrade FortiOS and FortiSwitchOS to 7.2.8+ / 7.4.3+ |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | Legacy FortiLink driver did not enforce strict edge BPDU drops |
Platform Impact: Affects FortiGate 60F through 400F models managing FortiSwitch 100, 200, 400, and 500 series switches deployed in standalone or FortiLink split-interface topologies.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to verify whether your FortiLink controller is dropping switch discovery packets and evaluate port synchronization:
Diagnostic Commands
# 1. Dump real-time FortiLink switch discovery states and errors
diagnose switch-controller dump discovery
# 2. Check switch synchronization and configuration push status
execute switch-controller get-sync-status
# 3. Inspect MAC cache and CAPWAP tunnel state for managed switches
diagnose switch-controller switch-info mac-cache
# 4. Verify FortiLink bridge interface forwarding status
diagnose netlink brctl name host fortilinkRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the interactive Ferrite platform:
Frequently Asked Questions
FortiLink relies on Layer 2 discovery broadcasts and CAPWAP control packets over dedicated native VLAN 4094. When STP BPDU Guard or auto-edge port configurations are active on the FortiLink aggregate trunk or connected switch uplinks, incoming BPDUs trigger a protection drop, causing the switch to drop CAPWAP control frames and freeze in the discovery phase.
Yes. Disabling STP BPDU Guard on the FortiLink physical port members and clearing the discovery cache via 'diagnose switch-controller dump discovery' immediately restores CAPWAP handshakes with zero downtime to already established traffic.
FortiOS 7.2.8 and 7.4.3, combined with FortiSwitchOS 7.2.8+, automatically exempt native FortiLink management interfaces from STP BPDU Guard drops.