NSE5-FSW-AD-7-6: Fortinet NSE 5 - FortiSwitch 7.6 AdministratorDemo

A FortiSwitch that does not discover a FortiGate through FortiLink or FortiEdge Cloud continues operating in standalone, local management mode. Fortinet identifies standalone operation as Local Management and distinguishes it from FortiLink Remote Management.

Dynamic ARP Inspection uses a separate per-port trust setting. DAI ports are untrusted by default, so a port trusted for DHCP snooping must also be explicitly configured with the DAI arp-inspection-trust trusted setting.

A FortiSwitch sniffer profile can capture traffic directly on a selected switch interface, avoiding the need to configure ACLs or port mirroring merely to make that traffic available for analysis. The profile supports explicitly configured filters and capture limits; it does not automatically filter traffic or decrypt SSL/TLS.

Spanning Tree Protocol (STP) provides a loop-free Layer 2 topology by blocking redundant forwarding paths while retaining them for failover. Fortinet documents STP as a link-management protocol that ensures a loop-free Layer 2 network topology.

FortiLink authorization makes the FortiSwitch operate in FortiLink mode under FortiGate management. After authorization, the FortiSwitch reboots in FortiLink mode. Resetting a switch that is not in its factory-default configuration is a separate preparation action, not an irreversible effect of authorization.

DHCP snooping protects against rogue DHCP servers by allowing DHCP server reply traffic only on ports configured as trusted. FortiSwitch can also insert Option 82 relay-agent information into DHCP messages when the VLAN’s DHCP-snooping Option 82 setting is enabled.

An isolated PVLAN is the secondary VLAN type that prevents hosts connected to it from communicating with each other or with hosts in other secondary VLANs. Its hosts can communicate only with the primary VLAN’s promiscuous port, which can connect to the shared FortiGate firewall for internet access.

The FortiSwitch management interface uses native VLAN 4094, so the uplink must place untagged management traffic in VLAN 4094 and permit that VLAN to traverse the port. Configuring port24 with native VLAN 4094 and adding VLAN 4094 to its allowed VLAN list provides management-VLAN connectivity. Fortinet documents that the management VLAN is used as the native VLAN on the internal interface and that a port’s allowed VLAN list controls which VLAN-tagged traffic it can transmit and receive.

MCLAG groups two FortiSwitch units so that they appear as one logical switch to the network. The peers therefore use the same STP bridge ID; both can consequently report the same shared bridge as the MSTP root. The matching bridge MAC address and priority confirm that shared identity. Fortinet MCLAG documentation

The prelookup ACL stage is evaluated before Layer 2 and Layer 3 lookup processing, allowing actions to be applied at the earliest relevant point in the switching pipeline.

A LAG combines multiple physical links into one logical connection, so STP treats the aggregate as a single interface. An MC-LAG allows a client to form one logical LAG with two peer switches and presents those peers as a single logical switch to the client. Juniper: Understanding Multichassis Link Aggregation Groups

MAC-, IP address-, and protocol-based VLANs assign VLAN membership according to attributes in ingress packets, enabling traffic or device segmentation based on identity or protocol. This delivers dynamic segmentation similar in purpose to 802.1X-based VLAN assignment, but does not inherently require 802.1X or a RADIUS server.

The repeated FL_STATE_READY status indicates that the FortiSwitch has established FortiLink management with FortiGate and is discovered and authorized. The recurring flp_send_pkt control packets are FortiLink heartbeat traffic used to maintain the FortiLink connection. LLDP-MED inventory updates are not indicated by this FortiLink packet debug output.

LLDP-MED inventory management supports tracking network devices and determining characteristics including manufacturer, software and hardware versions, and serial or asset numbers.

FortiGate uses the FortiSwitch model to build the Faceplates view because the model defines the physical port layout and hardware capabilities displayed for the managed switch. Neighbor-discovery advertisements can provide connected-device information, but they do not define the switch’s own port faceplate.

The untagged VLAN list applies only to egress traffic: frames for VLANs in that list are transmitted without a VLAN tag. Each port has one native VLAN, which is assigned to untagged ingress frames and whose matching egress frames are also sent untagged. The allowed VLAN list, not the untagged VLAN list, governs VLANs permitted for both transmission and reception.

Recurring heartbeat traffic with acknowledgments while the FortiSwitch is in FL_STATE_READY indicates that FortiGate and the managed FortiSwitch have an established, active FortiLink connection. A FortiLink heartbeat is used to detect loss of the connection, so successful bidirectional exchanges are not consistent with a session-establishment or authorization-pending condition.

With DHCP snooping enabled, the port connected to an authorized DHCP server must be configured as trusted. The DHCP server is connected to port1, but port1 is untrusted; DHCP-snooping filtering therefore blocks DHCP traffic associated with that server path. A client-facing port such as port4 is normally left untrusted. Fortinet documents that DHCP blocking filters DHCP traffic on untrusted ports and that a port can be explicitly configured as a trusted DHCP-snooping interface.

Dynamic ARP Inspection validates ARP packets received from untrusted ports against valid IP-to-MAC bindings in the DHCP-snooping database. PC2’s valid binding is 10.0.10.30 to 00:09:0F:AB:00:0B; an ARP reply associating 10.0.10.254 with PC2’s MAC is invalid and is dropped.

FortiSwitch uses the hardware routing table for hardware-based Layer 3 forwarding and uses the forwarding information base (FIB) for route forwarding when a hardware-table lookup does not supply the route. Hardware routing can forward eligible routes and is not limited to dynamic routing.

With port-based 802.1X, authentication authorizes the port, so hosts behind that authenticated port receive access. A FortiSwitch port policy can specify the 802.1X security policy applied to ports. Fortinet supports both port-based and MAC-based authentication, so not every connected device must itself support 802.1X.

Upon authorization for FortiLink management, FortiSwitch saves its standalone configuration and switches its active configuration to the default FortiLink configuration. FortiGate then centrally manages the switch configuration.

An RSPAN session transports the copied traffic through a user-specified RSPAN VLAN that is dedicated to that session across the participating switches. Keeping this VLAN dedicated prevents normal data traffic and unnecessary VLAN membership from mixing with or receiving the flooded mirrored traffic.

FortiSwitch ACLs can perform traffic-processing actions, apply QoS handling such as policing or CoS queue assignment, and assign an outer VLAN tag. VLAN ID is used to classify matching traffic rather than as an action, and quarantine is a separate access-control capability. Fortinet ACL policy attributes