NSE5 FortiSwitch 7.6 flashcards
NSE5 FortiSwitch 7.6 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- FortiLink definition
- FortiLink is the management channel between a FortiGate and a FortiSwitch, carried over a physical port or LAG dedicated to FortiLink, allowing the FortiGate to push VLANs, policies, and firmware to the switch.
- Standalone FortiSwitch mode
- A management mode where the FortiSwitch is configured directly via its own GUI or CLI, without a FortiGate. It has its own admin plane and does not receive pushed configuration from a FortiGate.
- FortiSwitch authorization
- The step on the FortiGate where an unactivated FortiSwitch is approved for management. Unauthorized switches appear in the Unactivated list and cannot be configured until authorized.
- FortiSwitch stacking
- A configuration where supported FortiSwitch models are connected via dedicated stack ports to act as one logical switch, with one master and up to eight members per stack.
- MCLAG purpose
- Multi-Chassis LAG lets two FortiSwitches present a single LAG to a downstream device for redundancy. It requires an inter-switch link (ISL) and matching MCLAG configuration on both switches.
- FortiLink LAG
- A bundle of multiple physical links between a FortiGate and a FortiSwitch used for the FortiLink management channel, providing redundancy and throughput. Member ports must be dedicated to FortiLink.
- FortiSwitch firmware upgrade
- A FortiSwitch firmware upgrade can be performed from the FortiGate (FortiSwitch Controller), from the switch's own GUI in standalone mode, or via TFTP/USB. FortiGate-managed upgrades require FortiLink reachability.
- FortiSwitch default management IP
- Many standalone FortiSwitch models default to 192.168.1.99/24 on the management port, reachable via GUI or SSH, before any FortiLink management is configured.
- Access port mode
- A FortiSwitch port mode carrying a single untagged VLAN, typically used for end-user devices. The port belongs to exactly one VLAN and does not tag frames.
- Trunk port mode
- A FortiSwitch port mode carrying multiple tagged VLANs, typically used for uplinks. The native VLAN on a trunk port is the one sent untagged.
- Native VLAN
- On a trunk port, the native VLAN is the VLAN whose frames are sent untagged. Frames from all other VLANs on the trunk are tagged with an 802.1Q header.
- RSTP vs MSTP
- RSTP is the default spanning-tree mode on most FortiSwitch models. MSTP is used to interoperate with other vendors' MSTP domains and requires matching region name, revision, and VLAN-to-instance mapping.
- LACP LAG mode
- A link aggregation mode using 802.3ad LACP for failure detection and negotiation. Preferred over static LAGs because it detects member link failures. Configuration must match on both ends.
- LLDP on FortiSwitch
- The 802.1AB neighbor discovery protocol, enabled by default on FortiSwitch ports. It supports topology discovery, VoIP auto-configuration, and LLDP-MED voice VLAN assignment.
- QinQ tagging
- An 802.1ad feature that adds an outer VLAN tag to customer frames, allowing service providers to tunnel multiple customer VLANs across a provider network. Supported on select FortiSwitch models.
- Storm control
- A per-port limit on broadcast, multicast, or unknown-unicast traffic. When the limit is exceeded, the port can drop excess traffic or be shut down, preventing broadcast storms.
- IGMP snooping
- A FortiSwitch feature that inspects IGMP messages to constrain multicast traffic to ports with interested receivers. Without snooping, multicast is flooded to all ports in the VLAN.
- Internal VLAN
- The default management VLAN on a FortiSwitch, often VLAN 1. In FortiLink mode, the FortiGate creates a fortilink VLAN for management, and the switch's management IP resides on it.
- 802.1X roles
- In 802.1X, the FortiSwitch (or FortiGate) is the authenticator, the endpoint is the supplicant, and a RADIUS server such as FortiAuthenticator or NPS is the authentication server.
- MAB fallback
- MAC Authentication Bypass is an 802.1X fallback for devices that cannot run a supplicant. The switch authenticates the device using its MAC address against the RADIUS server.
- Port security MAC limit
- A per-port limit on the number of source MAC addresses learned. When exceeded, the port can drop traffic, shut down, or send an SNMP trap, mitigating MAC flooding attacks.
- DHCP snooping
- A feature that distinguishes trusted uplink ports from untrusted access ports. DHCP offers from untrusted ports are dropped, and a binding table is built for use by DAI and IP source guard.
- Dynamic ARP Inspection
- DAI validates ARP packets against the DHCP snooping binding table and drops ARP spoofing attempts. It requires DHCP snooping to be enabled and the binding table to be populated.
- IP source guard
- A feature that validates the source IP of packets on a port against the DHCP snooping binding table, preventing IP spoofing. It works alongside DHCP snooping.
- MAC address move detection
- FortiSwitch can detect when a MAC address moves between ports and can be configured to log or block the move, mitigating MAC spoofing and loop attacks.
- RADIUS CoA
- Change of Authorization lets a RADIUS server dynamically change a port's VLAN or re-authenticate a session. FortiSwitch supports CoA and RADIUS accounting for 802.1X deployments.
- FortiLink security configuration
- In FortiLink mode, 802.1X, MAB, DHCP snooping, DAI, and port security are configured on the FortiGate under WiFi & Switch Controller and pushed to the managed FortiSwitch.
- FortiLink status check
- On the FortiGate, WiFi & Switch Controller > Managed FortiSwitches shows each switch's status (Connected/Disconnected), firmware version, model, and uplink port status.
- MAC table diagnostic
- The command diagnose switch mac-address-table (or FortiSwitch Clients on the FortiGate) shows learned MACs per port and VLAN. A MAC flapping between ports indicates a loop.
- STP state diagnostic
- The command diagnose switch stp shows the STP role and state per port. Blocking or alternate states indicate redundant paths; flapping states indicate a loop or misconfiguration.
- PoE status diagnostic
- The command diagnose switch poe status shows per-port PoE power, class, and status. A port delivering no power may be over budget, disabled, or the powered device may not be negotiating.
- FortiSwitch out-of-sync firmware
- A FortiSwitch whose firmware does not match the FortiGate's expected version shows as Out of Sync in the FortiSwitch Controller. The FortiGate can push the correct firmware, and the switch reboots to apply it.