Replacing a failed FortiSwitch in an Multi-Chassis Link Aggregation (MCLAG)

By Manny Fernandez

May 22, 2026

Replacing a failed FortiSwitch in an Multi-Chassis Link Aggregation (MCLAG)

Replacing a failed FortiSwitch in an Multi-Chassis Link Aggregation (MCLAG) pair requires a bit of care to prevent network loops and ensure the FortiGate correctly maps the old configuration to the new hardware.

The most efficient and reliable method leverages FortiOS’s replace-device command. For non MCLAP, FortiSwitch replacements, see the article I wrote earlier. Here is the step-by-step workflow to swap out the unit safely.

Phase 1: Isolation & Preparation

1. Document – Document your uplinks, Inter-Chassis Links, etc.

You should label your cables if possible. You can purchase these or similar cheap labels and label your cables. If all ports are on the same VLAN, maybe not that important.

Before connecting anything to your live production network, isolate the replacement switch to stage it correctly.

2. Disconnect the Failed Switch – Physical Isolation.

Unplug all physical connections (downlinks, FortiLink uplinks, and Inter-Chassis Links/ICL) from the failed FortiSwitch and remove it from the rack. Do not connect the new switch yet.

3. Stage the Replacement Unit – Offline Preparation.

Power on the replacement FortiSwitch in isolation (completely disconnected from the production network).

If the switch isn’t brand new, run: execute factoryreset
Upgrade or downgrade its firmware version so it exactly matches the firmware version of the surviving MCLAG peer.
Note: If you had custom phy-mode settings (like split ports) on the original switch, configure those manually now via the local console.

4. Deauthorize the Dead Switch – FortiGate CLI.

Starting in modern FortiOS branches (7.0.8+), you must explicitly deauthorize a managed switch before replacing it to avoid mapping errors. Run this on your FortiGate:

config switch-controller managed-switch
    edit 
        set fsw-wan1-admin disable
    end

Phase 2: Configuration Remapping

This is where the magic happens. Instead of rebuilding your VLANs, trunk groups, and port assignments, you will map the existing configuration directly to the new serial number.

From the FortiGate `CLI, execute the following command:

execute replace-device fortiswitch <FAILED_SWITCH_SERIAL> <REPLACEMENT_SWITCH_SERIAL>

What this does: The FortiGate retains every single port setting, VLAN assignment, and policy associated with the old switch ID and seamlessly updates its database with the new serial number.

Next, authorize the new switch on the FortiGate:

config switch-controller managed-switch
    edit <REPLACEMENT_SWITCH_SERIAL>
        set fsw-wan1-admin enable
    end

Phase 3: Physical Reconnection & Validation

When reintroducing an MCLAG peer, always bring up the infrastructure links first to establish stability before letting client traffic down the links.

Step 1: Connect the Inter-Chassis Links (ICL) and FortiLink Uplinks Only

Connect the dedicated ICL ports to the surviving peer switch, and connect your uplinks to the FortiGate.
Step 2: Allow Configuration Sync

Wait a few minutes. The replacement switch will form its FortiLink management connection to the FortiGate and pull down its complete assigned configuration profile.
Step 3: Verify MCLAG State

Before connecting access ports or downstream trunks, verify that the dual-homed sync state is completely healthy. Run these commands on the FortiGate:
```
diagnose switch mclag icl
diagnose switch mclag peer-consistency-check
```

Ensure the ICL trunk status reports as Up and that there are no peer-consistency mismatches between the two switches.

Step 4: Reconnect Downlinks. Once the control plane and ICL are confirmed clean and stable, patch the remaining production downlinks into the replacement switch.

Replacing a failed FortiSwitch in an Multi-Chassis Link Aggregation (MCLAG)

Phase 1: Isolation & Preparation

Phase 2: Configuration Remapping

Phase 3: Physical Reconnection & Validation

Recent posts