NSE5 FortiSwitch 7.6 key terms

The management tunnel and protocol that connects a managed FortiSwitch to a FortiGate, carrying configuration, monitoring, and control traffic over a dedicated or shared interface.

A FortiSwitch authorized and controlled by a FortiGate over FortiLink, whose VLANs, ports, and security profiles are configured from the FortiGate rather than locally.

Operating a FortiSwitch without a FortiGate controller, where all configuration is applied locally through the CLI, GUI, or a FortiManager-managed template.

The FortiGate interface, physical or aggregate, that terminates the FortiLink tunnel and is assigned the management IP used to reach managed switches.

The FortiGate feature set that discovers, authorizes, and configures managed FortiSwitches, including VLAN assignment, port profiles, and firmware operations.

A discovered FortiSwitch that an administrator has explicitly accepted on the FortiGate; until authorized, the switch receives no configuration and cannot forward controlled traffic.

The process by which a FortiSwitch locates a controlling FortiGate, typically via DHCP options, LLDP, or a configured controller address, so it can join FortiLink.

Multi-Chassis Link Aggregation, a FortiSwitch feature that lets two switches present a single logical LAG to downstream devices for redundancy and active-active forwarding.

Inter-Chassis Link, the dedicated link between two MCLAG peer switches that carries synchronized state and forwards traffic if a peer or uplink fails.

Link Aggregation Group, a bundle of physical ports treated as one logical interface using LACP or static mode to add bandwidth and link-level redundancy.

Link Aggregation Control Protocol, an IEEE 802.3ad/802.1AX protocol that negotiates and monitors which member links may actively forward traffic in a LAG.

A Layer 2 loop-prevention protocol that elects a root bridge and blocks redundant paths, with FortiSwitch supporting STP, RSTP, and MSTP modes.

Multiple Spanning Tree Protocol, an IEEE 802.1s variant that maps VLANs to independent spanning tree instances so blocked links can still carry other VLANs.

A port security feature that disables or blocks a port when it receives spanning tree BPDUs, protecting edge ports from accidental or malicious switch connections.

A spanning tree protection that places a port in a blocking state if it receives superior BPDUs, preventing an unauthorized downstream switch from becoming root.

A virtual LAN that segments a switch into separate broadcast domains, with each VLAN identified by an 802.1Q tag or a port's native untagged assignment.

A port mode that carries multiple VLANs by inserting a four-byte tag identifying the VLAN on each frame, used for switch-to-switch and switch-to-firewall links.

A switch port assigned to exactly one VLAN that forwards untagged frames to an endpoint such as a workstation or printer.

The VLAN whose frames are sent untagged on an 802.1Q trunk; both ends of the trunk must agree on it to avoid misforwarding or VLAN hopping.

The list of VLANs a trunk port is permitted to carry; frames tagged with any other VLAN are dropped, which limits broadcast propagation and tightens segmentation.

A VLAN configuration that isolates hosts within the same subnet using primary and secondary VLANs, so ports can reach an uplink but not each other.

A reusable FortiGate object, also called a FortiSwitch port template, that bundles VLAN membership, security settings, and port attributes for assignment to managed switch ports.

A set of restrictions on a switch port, such as limiting learned MAC addresses, that prevents unauthorized devices from attaching and flooding the forwarding table.

A learned MAC address pinned to a port so it persists across link events; frames from other addresses are dropped until the entry is cleared or aged out.

The maximum number of source MAC addresses a port may learn; exceeding it triggers the configured violation action, such as dropping traffic or shutting the port.

A port-based network access control standard where a supplicant authenticates through an authenticator to a RADIUS server before the port grants normal access.

MAC Authentication Bypass, a fallback where the switch sends a device's MAC address to RADIUS as credentials for endpoints that cannot run 802.1X supplicant software.

A AAA protocol used by FortiSwitch to authenticate, authorize, and account for supplicants, returning attributes such as VLAN assignment or dynamic ACLs.

A VLAN assigned to a port at authentication time based on RADIUS attributes rather than static configuration, letting users inherit segmentation wherever they connect.

A restricted VLAN where 802.1X ports place unauthenticated devices, usually granting limited services while the supplicant completes authentication.

A Layer 2 security feature that inspects DHCP messages, trusts only designated uplink ports, and builds a binding table used to block rogue DHCP servers.

A feature that validates ARP packets against the DHCP snooping binding table, dropping forged replies that would poison hosts' ARP caches and enable interception.

A rate limit on broadcast, multicast, or unknown unicast traffic per port; traffic above the configured threshold is dropped or the port is blocked.

A protection that blocks a port when spanning tree BPDUs stop arriving, preventing a unidirectional link failure from creating an undetected Layer 2 loop.

The forwarding database that maps learned source MAC addresses to switch ports and VLANs, used to forward frames only out the relevant port.

Link Layer Discovery Protocol, used by FortiSwitch to advertise identity and capabilities to neighbors and to help discover a controlling FortiGate.

A saved copy of a switch's running configuration, used to restore service after failure or to compare changes; backups are essential before firmware upgrades.

The process of installing a new FortiSwitch OS image, which can be staged from the FortiGate for managed switches and requires a reboot to activate.