FCSS LAN Edge 7.6 cheat sheet

LAN Edge in FortiOS 7.6 unifies FortiGate-managed FortiSwitch and FortiAP devices under one fabric: switches and APs are authorized, provisioned, and monitored from the FortiGate rather than from separate controllers.

FortiLink is the management tunnel between a FortiGate and a FortiSwitch; it runs over a dedicated LAG or a single link and carries CAPWAP-style control traffic, so the FortiGate acts as the switch controller.

CAPWAP is the control and data protocol between FortiGate (WLC role) and FortiAP; control runs over UDP 5246 and data over UDP 5247 by default.

Admin profiles on FortiOS 7.6 define read/write scope per VDOM and per feature; a LAN Edge administrator typically needs switch-controller and wireless-controller read-write access plus policy access.

VDOMs isolate switch and AP management: a FortiSwitch or FortiAP is authorized in exactly one VDOM, and managed-switch or managed-AP objects are visible only in that VDOM.

Configuration backup scope matters: 'backup all' includes switch and AP configuration, while a plain config backup excludes FortiSwitch and FortiAP settings, which are stored separately.

Firmware compatibility between FortiGate and FortiSwitch/FortiAP is version-bound: FortiOS 7.6 supports specific FortiSwitch and FortiAP firmware branches, and mismatched images can block authorization or feature use.

The LAN Edge license model ties FortiSwitch and FortiAP management to FortiGate capacity; exceeding supported device counts prevents further authorization until capacity is freed.

FortiSwitch authorization modes: 'auto-discovery' authorizes unknown switches automatically, while 'manual' requires an administrator to authorize each serial number before it becomes a managed-switch.

A managed FortiSwitch can be provisioned from a model-level or global template; per-switch overrides take precedence over template values for VLANs, ports, and static routes.

FortiLink LAG uses LACP with MCLAG support: two FortiGates in an HA pair can each connect to the same FortiSwitch pair, giving redundant control and data paths.

FortiSwitch standalone mode runs the switch without a FortiGate controller; converting to managed mode requires the FortiLink interface configuration and a factory reset or explicit mode change.

Port profiles bundle VLAN membership, native VLAN, PoE, STP, and security settings; assigning a port profile to a port is the standard way to standardize access-edge configuration.

FortiSwitch VLANs are defined on the FortiGate and pushed to the switch; a VLAN must exist on both the FortiGate (interface) and the managed switch before it can be assigned to a port.

IGMP snooping, DHCP snooping, and dynamic ARP inspection on FortiSwitch are configured as global or per-VLAN settings and depend on trusted-port designation to avoid blocking legitimate servers.

FortiSwitch stacking and MCLAG differ: stacking combines switches into one logical unit with a single management IP, while MCLAG keeps separate management but provides active-active redundant links.

FortiAP operational modes include bridge (local bridging at the AP), tunnel (CAPWAP data to the FortiGate), and mesh; the mode determines whether client traffic traverses the FortiGate data path.

An SSID maps to a FortiGate wireless interface; the wireless interface's IP subnet and DHCP scope determine client addressing in tunnel mode, while bridge mode uses the wired VLAN at the AP.

FortiAP profiles carry radio settings (band, channel width, TX power), SSID-to-VAP mapping, and Ethernet/LAN settings; a per-AP override supersedes the profile value.

WPA3-Enterprise and WPA3-Personal (SAE) require FortiAP hardware and firmware support; transition mode allows WPA2 and WPA3 clients on the same SSID during migration.

802.11r fast BSS transition, 802.11k neighbor reports, and 802.11v BSS transition management are configured per VAP and require consistent mobility domain and security settings across APs.

AP authorization is similar to switch authorization: auto-discovery or manual serial-number approval, and an unauthorized AP cannot serve clients even if it boots and joins the network.

Channel planning uses either automatic radio resource provisioning or manual static channels; 5 GHz and 6 GHz channels should be non-overlapping, and 2.4 GHz limited to 1, 6, and 11.

A FortiAP local bridge mode requires the AP's wired uplink to carry the client VLAN as a tagged or native VLAN; misconfigured uplink tagging is a common cause of clients getting no address.

802.1X on FortiSwitch ports can be terminated by the FortiGate itself or by an external RADIUS server; MAB (MAC authentication bypass) is a fallback for devices without supplicants.

FortiGate NAC policies can assign dynamic VLANs to wired and wireless clients based on user group, device category, or posture check results.

Security fabric integration lets FortiSwitch and FortiAP events (rogue AP detection, port violations, device offline) appear in FortiGate logs and trigger automation stitches.

Rogue AP detection classifies neighboring APs as accepted, rogue, or unclassified; only accepted APs are excluded from alerts, and classification is per-AP-profile.

Wireless intrusion prevention features include deauthentication attack detection, spoofed MAC detection, and evil-twin detection; these are VAP-level settings that generate log events rather than automatic blocks by default.

Common FortiSwitch troubleshooting order: verify FortiLink link state, check authorization status, confirm firmware match, then inspect VLAN and port profile assignment.

Common FortiAP troubleshooting order: confirm CAPWAP reachability (UDP 5246/5247) and authorization, check AP profile and VAP mapping, then verify client DHCP path and VLAN tagging.

Diagnose commands: 'diagnose switch controller ...' on the FortiGate for switch state, and 'diagnose wireless-controller wlac ...' for AP and client state; 'execute wireless-controller ...' handles AP-level operations.

FortiLink is the management tunnel between a FortiGate and a FortiSwitch; it runs over a dedicated LAG or a single link and carries CAPWAP-style control traffic, so the FortiGate acts as the switch controller.

CAPWAP is the control and data protocol between FortiGate (WLC role) and FortiAP; control runs over UDP 5246 and data over UDP 5247 by default.

Admin profiles on FortiOS 7.6 define read/write scope per VDOM and per feature; a LAN Edge administrator typically needs switch-controller and wireless-controller read-write access plus policy access.

VDOMs isolate switch and AP management: a FortiSwitch or FortiAP is authorized in exactly one VDOM, and managed-switch or managed-AP objects are visible only in that VDOM.

Configuration backup scope matters: 'backup all' includes switch and AP configuration, while a plain config backup excludes FortiSwitch and FortiAP settings, which are stored separately.

Firmware compatibility between FortiGate and FortiSwitch/FortiAP is version-bound: FortiOS 7.6 supports specific FortiSwitch and FortiAP firmware branches, and mismatched images can block authorization or feature use.

The LAN Edge license model ties FortiSwitch and FortiAP management to FortiGate capacity; exceeding supported device counts prevents further authorization until capacity is freed.

FortiSwitch authorization modes: 'auto-discovery' authorizes unknown switches automatically, while 'manual' requires an administrator to authorize each serial number before it becomes a managed-switch.

A managed FortiSwitch can be provisioned from a model-level or global template; per-switch overrides take precedence over template values for VLANs, ports, and static routes.

FortiLink LAG uses LACP with MCLAG support: two FortiGates in an HA pair can each connect to the same FortiSwitch pair, giving redundant control and data paths.

FortiSwitch standalone mode runs the switch without a FortiGate controller; converting to managed mode requires the FortiLink interface configuration and a factory reset or explicit mode change.

Port profiles bundle VLAN membership, native VLAN, PoE, STP, and security settings; assigning a port profile to a port is the standard way to standardize access-edge configuration.

FortiSwitch VLANs are defined on the FortiGate and pushed to the switch; a VLAN must exist on both the FortiGate (interface) and the managed switch before it can be assigned to a port.

IGMP snooping, DHCP snooping, and dynamic ARP inspection on FortiSwitch are configured as global or per-VLAN settings and depend on trusted-port designation to avoid blocking legitimate servers.

FortiSwitch stacking and MCLAG differ: stacking combines switches into one logical unit with a single management IP, while MCLAG keeps separate management but provides active-active redundant links.

FortiAP operational modes include bridge (local bridging at the AP), tunnel (CAPWAP data to the FortiGate), and mesh; the mode determines whether client traffic traverses the FortiGate data path.

An SSID maps to a FortiGate wireless interface; the wireless interface's IP subnet and DHCP scope determine client addressing in tunnel mode, while bridge mode uses the wired VLAN at the AP.

FortiAP profiles carry radio settings (band, channel width, TX power), SSID-to-VAP mapping, and Ethernet/LAN settings; a per-AP override supersedes the profile value.

WPA3-Enterprise and WPA3-Personal (SAE) require FortiAP hardware and firmware support; transition mode allows WPA2 and WPA3 clients on the same SSID during migration.

802.11r fast BSS transition, 802.11k neighbor reports, and 802.11v BSS transition management are configured per VAP and require consistent mobility domain and security settings across APs.

AP authorization is similar to switch authorization: auto-discovery or manual serial-number approval, and an unauthorized AP cannot serve clients even if it boots and joins the network.

Channel planning uses either automatic radio resource provisioning or manual static channels; 5 GHz and 6 GHz channels should be non-overlapping, and 2.4 GHz limited to 1, 6, and 11.

A FortiAP local bridge mode requires the AP's wired uplink to carry the client VLAN as a tagged or native VLAN; misconfigured uplink tagging is a common cause of clients getting no address.

802.1X on FortiSwitch ports can be terminated by the FortiGate itself or by an external RADIUS server; MAB (MAC authentication bypass) is a fallback for devices without supplicants.

FortiGate NAC policies can assign dynamic VLANs to wired and wireless clients based on user group, device category, or posture check results.

Security fabric integration lets FortiSwitch and FortiAP events (rogue AP detection, port violations, device offline) appear in FortiGate logs and trigger automation stitches.

Rogue AP detection classifies neighboring APs as accepted, rogue, or unclassified; only accepted APs are excluded from alerts, and classification is per-AP-profile.

Wireless intrusion prevention features include deauthentication attack detection, spoofed MAC detection, and evil-twin detection; these are VAP-level settings that generate log events rather than automatic blocks by default.

Common FortiSwitch troubleshooting order: verify FortiLink link state, check authorization status, confirm firmware match, then inspect VLAN and port profile assignment.

Common FortiAP troubleshooting order: confirm CAPWAP reachability (UDP 5246/5247) and authorization, check AP profile and VAP mapping, then verify client DHCP path and VLAN tagging.

Diagnose commands: 'diagnose switch controller ...' on the FortiGate for switch state, and 'diagnose wireless-controller wlac ...' for AP and client state; 'execute wireless-controller ...' handles AP-level operations.

FortiAP operational modes include bridge (local bridging at the AP), tunnel (CAPWAP data to the FortiGate), and mesh; the mode determines whether client traffic traverses the FortiGate data path.

An SSID maps to a FortiGate wireless interface; the wireless interface's IP subnet and DHCP scope determine client addressing in tunnel mode, while bridge mode uses the wired VLAN at the AP.

FortiAP profiles carry radio settings (band, channel width, TX power), SSID-to-VAP mapping, and Ethernet/LAN settings; a per-AP override supersedes the profile value.

WPA3-Enterprise and WPA3-Personal (SAE) require FortiAP hardware and firmware support; transition mode allows WPA2 and WPA3 clients on the same SSID during migration.

802.11r fast BSS transition, 802.11k neighbor reports, and 802.11v BSS transition management are configured per VAP and require consistent mobility domain and security settings across APs.

AP authorization is similar to switch authorization: auto-discovery or manual serial-number approval, and an unauthorized AP cannot serve clients even if it boots and joins the network.

Channel planning uses either automatic radio resource provisioning or manual static channels; 5 GHz and 6 GHz channels should be non-overlapping, and 2.4 GHz limited to 1, 6, and 11.

A FortiAP local bridge mode requires the AP's wired uplink to carry the client VLAN as a tagged or native VLAN; misconfigured uplink tagging is a common cause of clients getting no address.