Recommended FortiSwitch Root Cause Analysis

When a critical network issue occurs in a FortiSwitch environment – such as sudden disconnects, loop storms, or unexpected reboots like in a event featured in this article – the immediate reflex for many admins is to reboot or reset the equipment to restore connectivity. However, doing so clears vital volatile memory, rendering post-incident Root Cause Analysis (RCA) almost impossible.

To determine why an outage occurred and prevent it from recurring, you must gather essential diagnostic data before rebooting or resetting any device.

What to Capture Before Restarting

Before executing any reboot, ensure you document and collect the following:

• Issue Interval: Exact timestamp when the problem started and resolved.
• Recent Changes: Any configuration, topology, or hardware modifications made prior to the event.
• Visual Topology: Network diagrams and screenshots of the FortiGate switch-controller topology view.
• System Logs & State: Command outputs from both the FortiGate and FortiSwitch (detailed below).

Diagnostic Commands

Execute these diagnostic commands while the issue is occurring or immediately after, but before rebooting:

On the FortiGate (Switch Controller)

# Verify connection status between FortiGate and FortiSwitch
execute switch-controller get-conn-status
execute switch-controller diagnose-connection

# Check Spanning Tree Protocol (STP) state and topology
diagnose switch-controller switch-info stp

# Check aggregate/trunk status and configuration
diagnose switch-controller switch-info trunk config
diagnose switch-controller switch-info trunk status

On the FortiSwitch Directly

# Generate a full system diagnostic report
diag debug report

# Check for hardware or software crashes
diag debug crashlog read

# Export full active configuration
show full

By capturing these outputs prior to any hardware reset, you preserve critical evidence needed by support teams to perform a successful Root Cause Analysis.

Tip: Save and use this output for any subsequent tickets that you raise with either our BOLL technicians or directly with the Fortinet support team.