FortiSwitch VLANs and Layer 2 Configuration
What this domain tests
VLANs and Layer 2 tests your ability to build clean broadcast domains and pass them correctly over FortiLink: VLAN creation, access versus trunk ports, native/untagged VLAN, allowed VLAN lists, STP, LAG/MCLAG, LLDP, and multicast snooping.
Core rules
- A VLAN is a broadcast domain. In FortiLink mode, create the VLAN on the FortiGate switch controller and assign it to managed-switch ports; in standalone mode, create it locally on the switch.
- An access port carries one VLAN for untagged traffic. A trunk port carries multiple tagged VLANs and normally one untagged native VLAN. On FortiSwitch-style CLI, the native VLAN is the untagged VLAN and allowed VLANs are the tagged VLANs permitted on the link.
- The FortiLink interface is itself a trunk. Any VLAN used by hosts behind the switch must be allowed on the FortiLink, or the traffic reaches the switch but cannot reach the FortiGate gateway.
- A native VLAN mismatch does not necessarily down the link. It silently places untagged frames in different VLANs at each end, producing wrong DHCP scopes and intermittent connectivity.
- STP/RSTP prevents loops when redundant L2 paths exist. Edge ports should face endpoints; uplinks should participate in STP. A FortiLink LAG is treated as one logical path; MCLAG provides active-active redundancy without a blocked uplink.
- LAG members must match in speed, duplex, and VLAN configuration. LACP negotiates the bundle; static LAG does not. LLDP is the first tool for confirming what is actually connected to a port. IGMP snooping limits multicast flooding; a querier is needed on the VLAN.
Worked example
Port 1 connects a PC that must be in VLAN 20. Port 2 is a trunk to another switch carrying VLAN 10 and VLAN 20, with VLAN 99 as native. Configure port 1 as access VLAN 20. Configure port 2 with native VLAN 99 and allowed VLANs 10 and 20. On the FortiLink, allow VLANs 10, 20, and 99. The PC's untagged frames enter VLAN 20; tagged frames from the downstream switch enter VLAN 10 or 20; untagged trunk frames enter VLAN 99. If VLAN 20 is missing from the FortiLink allowed list, the PC can ARP locally but cannot reach its gateway.
Traps that cost marks
- Creating the VLAN only on the switch and forgetting the FortiLink allowed list.
- Putting the native VLAN on an access port and expecting tagged frames to work.
- Assuming the FortiSwitch will route between VLANs; in FortiLink designs the FortiGate normally does inter-VLAN routing.
- Mismatched LAG member settings or cabling two independent switches into one FortiLink LAG.