Overview
If FortiSwitches do not appear in Auvik’s topology or inventory, but SNMP or SSH appears to be working, the issue may be related to FortiGate API authorization.
When FortiSwitches are managed through FortiLink, Auvik commonly retrieves switch inventory, interfaces, and topology information through the FortiGate REST API. SNMP or SSH working on the switch does not necessarily confirm that the FortiGate API can enumerate the switch.
What to verify first
Confirm SNMP and device reachability
If the FortiSwitches are being monitored directly, verify:
- The Auvik Collector can reach the switch management IPs.
- ICMP and UDP 161 are permitted where required.
- The SNMP community or SNMPv3 credentials in Auvik match the switch configuration.
- SNMP access control lists allow the Collector’s IP address.
- Routing and firewall policies permit traffic between the Collector and the switch management network.
Direct SNMP polling is not normally required when FortiLink switch information is being collected successfully through the FortiGate API.
Confirm FortiGate API status
In Auvik:
- Go to Discovery > Manage Credentials.
- Open the Fortinet Device API credential.
- Confirm that the credential is assigned to the correct FortiGate.
- Review the credential status.
- Test the credential if the status is Not Authorized, failed, or otherwise unhealthy.
On the FortiGate, confirm that:
- The REST API administrator is enabled.
- The API token is valid and has not been revoked or regenerated.
- The administrator is assigned to the correct profile.
- The profile includes read access to the FortiGate and FortiLink switch-controller information.
- HTTPS access is enabled on the interface used by the Auvik Collector.
- The Collector IP address is included in the Trusted Hosts list.
FortiLink-specific requirements
Confirm that:
- The FortiSwitches are operating in FortiLink mode.
- The switches appear as managed and authorized in the FortiGate interface.
- The FortiGate can see the expected switch inventory.
- FortiLink is operating normally.
- The API credential is configured for the FortiGate management IP address, not a FortiSwitch address.
- The Auvik Collector can reach the FortiGate over HTTPS, normally TCP 443.
If the FortiGate cannot see the FortiSwitches, Auvik cannot retrieve them through the FortiGate API.
Getting a FortiSwitch to Appear in Auvik
If a FortiSwitch managed by a FortiGate does not appear in Auvik:
- On the FortiGate, confirm that FortiLink is enabled and active for the switch.
- Confirm that the FortiSwitch appears as managed, authorized, and online in the FortiGate interface.
- Re-check the FortiGate API credentials configured in Auvik, including the API administrator permissions required to read FortiLink switch information.
- In Auvik, rescan the FortiGate and its connected devices or neighbors.
- Allow the next discovery or polling cycle to complete, then check inventory and topology again.
- If the switch is still missing, attempt direct discovery using valid SNMP credentials to determine whether the collector can reach the switch and retrieve its identity.
Direct SNMP discovery can help validate connectivity, but it is not normally required when FortiLink switch information is being collected successfully through the FortiGate API.
Verify the API Administrator Profile
The API profile must include the permissions required to read FortiSwitch information. Verify the permissions required by the current Auvik Fortinet integration, including read access to areas such as:
- Firewall address information
- Network configuration
- Network routing
- System configuration
- WiFi & Switch Controller
Do not grant administrative write access unless it is required for another approved workflow.
Common API authorization problems
Invalid or replaced token
If the token was regenerated or revoked:
- Generate a new FortiGate API token.
- Update the Fortinet Device API credential in Auvik.
- Test the credential.
- Save the updated credential after the test succeeds.
Permissions are too limited
A successful connection test does not guarantee that the API account can read all FortiSwitch information.
Review the Administrator Profile and confirm that it can read FortiLink switch-controller and inventory data.
Trusted Hosts restriction
If Trusted Hosts are configured incorrectly, FortiGate may reject requests from Auvik even when the API token is valid.
Confirm that the Collector’s source IP address is included, preferably using a specific host entry such as:
192.168.1.10/32
Incorrect management address or port
Confirm that the Auvik credential uses:
- The FortiGate management IP address.
- The correct HTTPS management port.
- The interface reachable from the Auvik Collector.
Using a FortiSwitch IP instead of the FortiGate management IP can prevent FortiLink inventory from being retrieved.
After correcting the API credential
- Save the updated credentials in Auvik.
- Allow discovery and polling to run.
- Confirm that the FortiSwitches appear in inventory.
- Review the topology map.
- Verify that interface and relationship information is populating.
- Review Discovery or credential status for new errors.
The update may not appear immediately because discovery and polling occur on their configured schedules.
If topology information is incomplete
The FortiGate REST API provides switch inventory and interface information. Additional topology information may require:
- FortiGate login credentials for CLI collection.
- CLI access enabled for the Auvik credential.
- LLDP enabled where appropriate.
- Correct interface and peer mappings.
SNMP working on a FortiSwitch does not guarantee that all topology information will be available through direct polling.
Avoid duplicate devices
If FortiSwitches are visible through the FortiGate API, avoid also discovering the same switches through overlapping direct discovery ranges unless direct polling is specifically required.
If duplicate or conflicting devices appear:
- Review the FortiGate API integration.
- Check whether the FortiSwitch IP ranges are also included in direct discovery.
- Confirm that the same switch is not being managed through multiple integrations.
- Restrict direct discovery where the FortiGate API is the authoritative source.
- Allow discovery to update after correcting the configuration.
See Preventing Duplicate or Conflicting FortiSwitch Data in Auvik.
Information to provide Support
If the issue continues, provide:
- Auvik site or tenant URL.
- FortiGate management IP address.
- Affected FortiSwitch IP addresses or serial numbers.
- FortiOS and FortiSwitch firmware versions.
- FortiGate API credential status in Auvik.
- Any API or Discovery error messages.
- FortiGate API or administrative log entries.
- The timestamp and timezone when the issue was observed.
- Whether the switches are visible and authorized in the FortiGate FortiLink inventory.