Replacing a failed FortiSwitch in an Multi-Chassis Link Aggregation (MCLAG) pair requires a bit of care to prevent network loops and ensure the FortiGate correctly maps the old configuration to the new hardware.
The most efficient and reliable method leverages FortiOS’s replace-device command. For non MCLAP, FortiSwitch replacements, see the article I wrote earlier. Here is the step-by-step workflow to swap out the unit safely.
Phase 1: Isolation & Preparation
You should label your cables if possible. You can purchase these or similar cheap labels and label your cables. If all ports are on the same VLAN, maybe not that important.
Before connecting anything to your live production network, isolate the replacement switch to stage it correctly.
Phase 2: Configuration Remapping
This is where the magic happens. Instead of rebuilding your VLANs, trunk groups, and port assignments, you will map the existing configuration directly to the new serial number.
From the FortiGate `CLI, execute the following command:
execute replace-device fortiswitch <FAILED_SWITCH_SERIAL> <REPLACEMENT_SWITCH_SERIAL>
What this does: The FortiGate retains every single port setting, VLAN assignment, and policy associated with the old switch ID and seamlessly updates its database with the new serial number.
Next, authorize the new switch on the FortiGate:
config switch-controller managed-switch edit <REPLACEMENT_SWITCH_SERIAL> set fsw-wan1-admin enable end
Phase 3: Physical Reconnection & Validation
When reintroducing an MCLAG peer, always bring up the infrastructure links first to establish stability before letting client traffic down the links.
-
Step 1: Connect the Inter-Chassis Links (ICL) and FortiLink Uplinks OnlyConnect the dedicated ICL ports to the surviving peer switch, and connect your uplinks to the FortiGate.
-
Step 2: Allow Configuration SyncWait a few minutes. The replacement switch will form its FortiLink management connection to the FortiGate and pull down its complete assigned configuration profile.
-
Step 3: Verify MCLAG StateBefore connecting access ports or downstream trunks, verify that the dual-homed sync state is completely healthy. Run these commands on the FortiGate:
diagnose switch mclag icl diagnose switch mclag peer-consistency-check
Ensure the ICL trunk status reports as Up and that there are no peer-consistency mismatches between the two switches.
Step 4: Reconnect Downlinks. Once the control plane and ICL are confirmed clean and stable, patch the remaining production downlinks into the replacement switch.
