I85PREP
⌘ K
NSE5 FortiSwitch 7.6 study materials
NSE5 FortiSwitch 7.6 study resources

NSE5 FortiSwitch 7.6: FortiSwitch Security Features and Port Security

NSE5 FortiSwitch 7.6 · Work through your exam, one topic at a time.

All guide sections

FortiSwitch Security Features and Port Security

What this domain tests

Security Features and Port Security covers identity and admission at the edge: 802.1X, MAC authentication bypass (MAB), RADIUS-driven dynamic VLANs and CoA, DHCP snooping, dynamic ARP inspection (DAI), IP source guard, MAC-limiting port security, storm control, and quarantine actions.

Core rules

  • 802.1X has three roles: supplicant (endpoint), authenticator (FortiSwitch port), and authentication server (RADIUS). The switch blocks or restricts traffic until authentication succeeds. MAB uses the endpoint MAC as the credential, typically for printers or cameras that cannot run a supplicant.
  • Dynamic VLAN assignment comes from the RADIUS server (for example, Tunnel-Private-Group-ID). The assigned VLAN must exist on the switch and be allowed on the uplink/FortiLink, or authentication succeeds but connectivity fails. CoA lets RADIUS change authorization state without waiting for reauthentication.
  • Guest VLAN and auth-fail VLAN are fallback behaviors. They are not the same: guest VLAN is for unauthenticated guests, auth-fail is for failed credentials. MAB fallback should be deliberate, not an accidental bypass.
  • DHCP snooping builds a binding table of MAC/IP/port/VLAN and blocks DHCP offers on untrusted ports. Trust only the uplink toward the legitimate DHCP server. DAI checks ARP packets against those bindings; IP source guard checks source IP/MAC. Both depend on a populated snooping binding table.
  • Port security limits the number of learned MAC addresses on a port and can drop or shut down on violation. It is useful on access ports, but it counts every MAC, including a VoIP phone and a downstream hub.
  • Storm control limits broadcast, multicast, or unknown-unicast floods. DoS policies can drop malformed L2 traffic. Quarantine actions isolate a host after a policy or NAC verdict.

Worked example

A lobby port must admit managed PCs by 802.1X, admit printers by MAB, and place unknown devices in VLAN 60. Configure 802.1X with MAB fallback on the port, point the switch at the RADIUS server, and set guest VLAN 60. RADIUS returns VLAN 30 for authenticated PCs. VLANs 30 and 60 must exist and be allowed on the FortiLink. Enable DHCP snooping on VLAN 30, trust the uplink, and enable DAI. If DAI is enabled first with no snooping bindings, legitimate clients fail.

Traps that cost marks

  • Enabling 802.1X on an uplink or trunk instead of edge access ports.
  • Returning a dynamic VLAN that is not allowed on the FortiLink.
  • Trusting user-facing ports for DHCP snooping.
  • Setting a MAC limit lower than the combined phone and PC count.
  • Forgetting that MAB still requires a RADIUS entry and a usable MAC database.