NSE5 FortiSwitch 7.6 cheat sheet

FortiSwitch can be managed in three modes: standalone (local GUI/CLI), FortiLink-managed by a FortiGate (the switch becomes a managed switch with no independent admin plane), and via FortiLAN Cloud for supported models. The mode is chosen at first boot or by resetting to factory defaults.

FortiLink is FortiGate's management channel to FortiSwitch; it runs over a physical port (or an aggregated LAG) configured on the FortiGate as 'dedicated to FortiLink'. The FortiGate then pushes VLANs, policies, and firmware to the switch.

FortiSwitch models in the FortiLink-managed fleet appear under WiFi & Switch Controller > FortiSwitch Controller on the FortiGate; the switch's serial number is authorized there. Unauthorized switches appear in the 'Unactivated' list and cannot be configured until authorized.

Firmware upgrade paths: a FortiSwitch can be upgraded from the FortiGate (System > Firmware, or via FortiSwitch Controller > Managed FortiSwitches), from the switch's own GUI in standalone mode, or via TFTP/USB. FortiGate-managed upgrades require the FortiGate to reach the switch over the FortiLink.

FortiSwitch models are grouped into families (e.g., 1xx, 2xx, 3xx, 4xx, 5xx, 6xx, 7xx, and the 1xxE/2xxE/3xxE entry families). The model family determines supported features (e.g., PoE budget, stacking support, 10G uplinks).

Stacking: supported models can be stacked (up to 8 members in a stack) to act as one logical switch. Stack ports are dedicated (usually the two SFP+ ports on the rear) or can be configured on data ports. A stack has one master; other members are slaves.

FortiLink over LAG: multiple physical links between the FortiGate and the FortiSwitch can be bundled into a FortiLink LAG for redundancy and throughput. The FortiGate's FortiLink interface is a 'fortilink' type interface; the LAG members must be dedicated to FortiLink.

MCLAG (Multi-Chassis LAG) lets two FortiSwitches in a stack or two standalone FortiSwitches present a single LAG to a downstream device for redundancy. MCLAG requires an ISL (inter-switch link) between the two switches and matching MCLAG configurations on both.

Default management access: standalone FortiSwitch GUI/SSH on the management port (default 192.168.1.99/24 for many models) or on any port in the 'internal' VLAN. In FortiLink mode, management is via the FortiGate; the switch's local admin is disabled unless explicitly enabled.

VLANs on a FortiSwitch are defined either locally (standalone) or pushed from the FortiGate (FortiLink mode). In FortiLink mode, VLANs are created on the FortiGate as 'fortilink' sub-interfaces or as VLANs under the FortiSwitch Controller, and the FortiGate assigns them to switch ports.

Port modes: 'access' (one untagged VLAN, typically a user port), 'trunk' (multiple tagged VLANs, typically an uplink), and 'rspan' (remote SPAN, for mirroring). A port's native VLAN is the untagged VLAN on a trunk port.

The 'internal' VLAN is the default management VLAN on a FortiSwitch (often VLAN 1). In FortiLink mode, the FortiGate creates a 'fortilink' VLAN for management traffic; the switch's management IP is on this VLAN.

Spanning Tree Protocol: FortiSwitch supports STP, RSTP, and MSTP. RSTP is the default on most models. MSTP is used when interoperating with other vendors' MSTP domains; the region name, revision, and VLAN-to-instance mapping must match.

Link Aggregation (LAG): a LAG bundles multiple physical ports into one logical link. LAG modes include static (no LACP) and LACP (802.3ad). LACP is preferred for failure detection; the LAG must be configured identically on both ends.

LLDP (802.1AB) is enabled by default on FortiSwitch ports and is used for neighbor discovery, VoIP auto-configuration, and FortiLink topology. LLDP-MED extends this for voice VLAN assignment.

QinQ (802.1ad) and VLAN translation are supported on some FortiSwitch models for service-provider and multi-tenant deployments. QinQ adds an outer tag to customer frames.

Storm control: per-port limits on broadcast, multicast, and unknown-unicast traffic prevent broadcast storms. When the limit is exceeded, the port can drop excess traffic or be shut down (depending on configuration).

IGMP snooping: FortiSwitch can snoop IGMP to constrain multicast traffic to interested ports. Without snooping, multicast is flooded to all ports in the VLAN.

802.1X port-based authentication: the FortiSwitch (or the FortiGate in FortiLink mode) acts as the authenticator, the supplicant is the endpoint, and a RADIUS server (e.g., FortiAuthenticator, NPS) is the authentication server. MAB (MAC Authentication Bypass) is a fallback for devices that cannot run 802.1X.

Port security (MAC limiting): limits the number of source MAC addresses learned on a port. When the limit is exceeded, the port can be configured to drop, shut down, or send an SNMP trap. This mitigates MAC flooding attacks.

DHCP snooping: the switch distinguishes trusted ports (uplinks to the DHCP server) from untrusted ports (access ports). DHCP offers from untrusted ports are dropped. DHCP snooping builds a binding table used by Dynamic ARP Inspection (DAI).

Dynamic ARP Inspection (DAI): validates ARP packets against the DHCP snooping binding table, dropping ARP spoofing attempts. DAI requires DHCP snooping to be enabled and the binding table to be populated.

IP source guard: validates the source IP of packets on a port against the DHCP snooping binding table, preventing IP spoofing. It works alongside DHCP snooping.

Storm control and port blocking: per-port storm control limits broadcast/multicast/unknown-unicast; a 'blocked' port state can be used to quarantine a port administratively without removing its configuration.

FortiLink-managed security: in FortiLink mode, 802.1X, MAB, DHCP snooping, DAI, and port security are configured on the FortiGate (WiFi & Switch Controller > FortiSwitch Ports / FortiSwitch Security) and pushed to the switch.

MAC address movement and security: FortiSwitch can detect MAC address moves between ports and can be configured to take action (e.g., log, block) to mitigate MAC spoofing and loop attacks.

RADIUS accounting and CoA: FortiSwitch supports RADIUS accounting and Change of Authorization (CoA), allowing the RADIUS server to dynamically change a port's VLAN or re-authenticate a session.

FortiLink status: on the FortiGate, check WiFi & Switch Controller > Managed FortiSwitches for the switch's status (Connected/Disconnected), firmware version, and model. A disconnected switch shows the uplink port status.

On the FortiSwitch CLI, 'diagnose switch ...' commands (e.g., 'diagnose switch physical-ports', 'diagnose switch vlan', 'diagnose switch mac-address-table') provide port, VLAN, and MAC table information. In FortiLink mode, these are run from the FortiGate with 'execute switch ...' or via the switch's console.

'get switch status' and 'diagnose switch trunk' show LAG/trunk status and member link states. A LAG with mismatched member states usually indicates a cabling or LACP negotiation issue.

MAC address table: 'diagnose switch mac-address-table' (or the FortiGate's WiFi & Switch Controller > FortiSwitch Clients) shows learned MACs per port and VLAN. A MAC flapping between ports indicates a loop.

STP troubleshooting: 'diagnose switch stp' shows the STP role and state per port. A port in 'blocking' or 'alternate' state indicates a redundant path; a port flapping between states indicates a loop or misconfiguration.

PoE troubleshooting: 'diagnose switch poe status' shows per-port PoE power, class, and status. A port delivering no power may be over budget, disabled, or the powered device may not be negotiating.

Logs: FortiSwitch logs to the FortiGate (in FortiLink mode) or to a syslog server. Common log IDs include port up/down, STP topology changes, and 802.1X authentication failures.

Packet capture: on the FortiSwitch, use 'diagnose switch packet-capture' (or port mirroring/RSPAN) to capture traffic on a port. On the FortiGate, use 'diagnose sniffer packet' on the FortiLink interface.

Firmware mismatch: a FortiSwitch whose firmware does not match the FortiGate's expected version may show as 'Out of Sync' in the FortiSwitch Controller. The FortiGate can push the correct firmware; the switch reboots to apply it.