Replacing a FortiGate managed FortiSwitch

By Manny Fernandez

May 13, 2026

Replacing a FortiGate managed FortiSwitch

FortiSwitches are pretty rock solid from Mean Time Between Failures (MTBF), but if you had a situation where a FortiSwitch, being managed through a FortiGate with FortiLink fails, here are the steps to replace a downed switch. The key command is execute replace-device fortiswitch, which transfers the failed switch’s configuration to the new unit by remapping the serial number.

Procedure (non-MCLAG, standard FortiLink-managed switch)

1. Physically remove the failed FortiSwitch from the network, don’t connect the replacement yet.

2. Deauthorize the failed switch on the FortiGate (optional but clean):

config switch-controller managed-switch
edit <failed_serial_number>
set fsw-wan1-admin disable
end

3. Prep the replacement switch in isolation (not connected to the production network):
– If it’s not factory-fresh, run execute factoryreset on it.
– Upgrade its firmware to match the version that was running on the failed switch. Mismatched firmware is the most common cause of trouble.
– If the failed switch had split ports configured, log in and apply the same config switch phy-mode settings.

4. Run the replace-device command on the FortiGate

execute replace-device fortiswitch <failed_serial_number> <replacement_serial_number>

This is the magic step, the FortiGate keeps all the configuration (VLANs, port settings, policies, etc.) tied to the old serial number and just remaps it to the new switch’s serial.

5. Connect the replacement switch to the network via its FortiLink port. It should come up, get authorized, and pull down the full configuration from the FortiGate.

A few gotchas

– The replacement should be the same model as the failed one. Different models have different port layouts and the configuration won’t map cleanly.

– Firmware version must match before you plug it in, otherwise the FortiGate may push a different config or the switch may behave inconsistently during onboarding.

– If the failed switch is part of an MCLAG pair, only connect the ICL (inter-chassis link) initially to avoid loops, then bring up the other links once it’s stable. Fortinet specifically recommends backing up the failed switch’s config, restoring it to the replacement offline, then running the replace-device command before physically swapping.

– If you don’t use replace-device, the new switch will show up as a brand new unit and you’d have to manually reconfigure all the port assignments, VLANs, etc.

The whole point of execute replace-device fortiswitch is exactly your use case, bad switch, want to keep config, so that one command is really the answer.

Replacing a FortiGate managed FortiSwitch

Recent posts