Monitor FortiSwitches in FortiLink Mode Using the FortiOS REST API

When FortiSwitches are operating in FortiLink mode, they are managed through the FortiGate and may not be directly reachable by the Auvik collector.

In these environments, Auvik can collect switch inventory, interface, and topology information through the FortiOS REST API on the FortiGate.

This functionality is supported on FortiOS 6.0 and later releases.

Note: Auvik communicates with the FortiGate and retrieves FortiSwitch information through the FortiLink relationship. Direct connectivity to the FortiSwitch is not required.

Do I need to configure each FortiSwitch?

No. When FortiSwitches are managed through FortiLink, Auvik normally retrieves switch inventory, interface information, statistics, and topology through the FortiGate REST API. Direct SNMP access to each FortiSwitch is not normally required.

Configure the following on the FortiGate:

• FortiOS REST API access with the required read permissions
• A REST API administrator assigned to the appropriate profile
• Trusted Hosts access for the Auvik Collector
• HTTPS access from the Collector to the FortiGate

SNMP on the FortiGate may still be used to monitor the FortiGate itself, but it is not required for Auvik to collect FortiLink-managed switch information through the FortiGate API.

When direct SNMP may be required

Configure SNMP directly on a FortiSwitch only when:

• The FortiGate API does not expose the required information.
• The FortiOS or FortiSwitch version has limited API support.
• Specific switch-local metrics are unavailable through the FortiGate API.
• Auvik Support recommends direct polling for the environment.

If direct SNMP is enabled, confirm that:

• The Auvik Collector can reach the FortiSwitch management interface.
• UDP port 161 is permitted between the Collector and the switch.
• The SNMP credentials in Auvik match the FortiSwitch configuration.
• SNMP access control lists allow the Collector’s IP address.

Avoid enabling direct discovery and FortiGate API monitoring for the same FortiSwitches unless required. Using both methods can create duplicate devices, inconsistent device information, or conflicting topology.

Troubleshooting missing switch information

If FortiSwitches appear but have incomplete information:

• Confirm that the FortiSwitches are visible and managed in the FortiGate FortiLink inventory.
• Verify that the FortiGate API administrator has the required read permissions.
• Confirm that the API credential is assigned to the correct FortiGate in Auvik.
• Verify that the Collector can reach the FortiGate over HTTPS.
• Confirm that FortiLink is operating normally.
• If required information is not exposed through the API, consider direct SNMP as an alternative.

Related article: Preventing Duplicate or Conflicting FortiSwitch Data in Auvik

Information Collected from FortiSwitches

When the FortiOS REST API is configured, Auvik can collect information including:

Device Information

• Model
• Hostname
• IP address
• Serial number
• Operating system version
• Up/Down status
• Uptime

Interface Information

• Interface name
• Interface type
• MAC address
• Interface status
• Interface speed
• VLAN assignments
• Peer interface information

Traffic Statistics

• Inbound and outbound octets
• Inbound and outbound unicast traffic
• Inbound and outbound broadcast traffic
• Inbound and outbound multicast traffic
• Inbound and outbound errors
• Inbound and outbound discards

Switching Information

• MAC forwarding table

LLDP Discovery

Auvik can also collect LLDP topology information through the FortiGate CLI when login credentials are configured and CLI access is enabled.

Using both REST API and CLI credentials provides the most complete visibility into FortiLink-connected switches.

SNMP expectations in FortiLink mode

When a FortiSwitch is managed through FortiLink, Auvik retrieves the switch inventory and status through the FortiGate’s FortiOS REST API. Auvik does not need to poll the FortiSwitch directly through SNMP for this FortiLink monitoring method.

Because the switch is not being directly polled through SNMP, the FortiSwitch may show SNMP as Not Working in Auvik. This is expected and does not necessarily indicate a problem with the FortiGate API integration.

Through the FortiGate API, Auvik may collect information such as:

• FortiSwitch inventory.
• Hostname, model, serial number, and operating system.
• Interfaces and ports.
• Interface status and speed.
• VLAN assignments.
• Traffic statistics exposed by the FortiGate.
• FortiLink relationships and other controller-provided topology information.

SNMP data that requires direct access to the FortiSwitch, including switch-local MIB data that is not exposed by the FortiGate, is not collected through this FortiLink API method.

Avoid duplicate FortiSwitch devices

Do not configure overlapping discovery methods for the same FortiSwitches unless there is a specific monitoring requirement.

If FortiSwitches are managed through FortiLink and also discovered directly through Auvik network discovery, Auvik may create duplicate or conflicting device records.

To avoid this:

• Use the FortiGate API as the authoritative source for FortiLink-managed FortiSwitches.
• Exclude the FortiSwitch management IPs or subnets from direct discovery when appropriate.
• Confirm that the API integration is assigned to the correct FortiGate and Auvik site.
• Review the inventory and topology after changing discovery or API settings.
• Contact Support before deleting existing device records if you are unsure which record is API-generated.

Changes to discovery scopes, credentials, and FortiGate API settings require administrator access.

Configuration backups

Configuration backup behavior is separate from FortiLink inventory and monitoring. Do not assume that an API-populated FortiSwitch object can be backed up using the same method as a FortiGate.

Before documenting FortiSwitch configuration-backup steps, confirm the supported backup method, required protocol, device reachability, and credential requirements for the FortiOS and FortiSwitch versions in use.

For general backup troubleshooting, see Troubleshooting Configuration Backups in Auvik.

Configure the FortiGate

To allow Auvik to access FortiSwitch information, you must:

1. Create an API administrator profile.
2. Create a REST API administrator.
3. Add the API credentials to Auvik.

Create an Admin Profile

1. Log in to the FortiGate.
2. Navigate to System > Admin Profiles.
3. Click Create New.
4. Enter a profile name.

Configure the following permissions:

5. Click OK.

Note: These permissions provide sufficient access for Auvik to collect FortiSwitch information without granting administrative control.

Create a REST API Administrator

1. Navigate to System > Administrators.
2. Click Create New > REST API Admin.
3. Enter a username.
4. Select the admin profile created above.
5. Disable PKI Group unless required by your environment.

Trusted Hosts

Configure Trusted Hosts to allow the Auvik collector.

Use the collector IP address in CIDR format.

Example:

192.168.1.10/32

Recommendation: Use /32 whenever possible rather than broader ranges to limit API access to the collector only.

CORS Allow Origin

CORS configuration is not typically required when the collector is located within the local network.

6. Click OK.

The API token is displayed.

Important: Copy the API token immediately. The token cannot be viewed again after the window is closed.

7. Store the token securely.
8. Click Close.

Add the API Credentials to Auvik

Before creating the credential, determine:

• The management IP address of the FortiGate
• The HTTPS port used for management access (default: 443)

Important: If the wrong management IP address is configured, repeated authentication failures may trigger FortiGate security protections and temporarily block access attempts.

To add the credential:

1. Navigate to Discovery > Manage Credentials.
2. Select Device API Credentials.
3. Click Add Device API Credentials > Fortinet.

Enter:

4. Click Test Connection.
5. Verify the test succeeds.
6. Click Save.

Verify Discovery

After the credential has been added:

1. Allow Auvik time to perform discovery and polling.
2. Verify that FortiSwitch devices appear in inventory.
3. Confirm interface and topology information is being collected.

Depending on the number of FortiSwitches and the polling schedule, it may take several minutes before all information appears.

Troubleshooting

Test Connection Fails

Verify:

• The FortiGate management IP address is correct.
• HTTPS access is enabled.
• TCP port 443 (or the configured management port) is reachable from the collector.
• The API token was copied correctly.
• The collector IP is included in Trusted Hosts.

FortiSwitches Are Not Appearing

Verify:

• The switches are operating in FortiLink mode.
• The switches are managed by the FortiGate.
• The FortiGate can see the FortiSwitches in the FortiLink inventory.
• The API account has the required permissions.

Missing Topology Information

Verify:

• Login credentials have been configured in Auvik.
• CLI access is enabled.
• LLDP is enabled where appropriate.

REST API collection provides switch inventory and interface information, while CLI access may be required for additional topology data.

Additional Information

For the most complete FortiSwitch monitoring experience:

• Configure FortiOS REST API credentials.
• Configure FortiGate login credentials for CLI access.
• Ensure FortiLink is operating normally.
• Restrict API access using Trusted Hosts.

This combination provides inventory, interface statistics, switching information, and topology visibility for FortiLink-managed environments.

For more information on the FortiOS Rest, click here:  https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/92/