FCSS LAN Edge 7.6 key terms

Proprietary protocol that lets a FortiGate manage FortiSwitch units directly, carrying management, configuration, and monitoring traffic over a dedicated LAG or single link. It removes the need to administer each switch separately.

Link aggregation group formed between FortiGate interfaces and a managed FortiSwitch to carry FortiLink traffic with redundancy and higher bandwidth. Members must match on both ends; misconfigured membership is a common cause of switches showing offline.

A FortiSwitch authorized and controlled by a FortiGate over FortiLink. The FortiGate pushes configuration, firmware, and VLAN assignments to it, and the switch appears under WiFi & Switch Controller in the GUI.

A FortiSwitch running without FortiLink management, configured locally through its own CLI or GUI. It forwards traffic independently and is not visible as a managed device on a FortiGate.

FortiOS feature set, found under WiFi & Switch Controller, that discovers, authorizes, and provisions FortiSwitch units and their VLANs, ports, and PoE settings from the FortiGate.

Multi-chassis link aggregation that lets two FortiSwitch units act as one logical aggregation endpoint, so downstream devices use redundant links to both switches without spanning-tree blocking. Requires an ISL between the peers and matching MCLAG configuration.

FortiSwitch feature that divides a single physical port into two or four logical interfaces at reduced speed, each behaving as a separate port for VLANs and policies. Useful for dense cabling where full-rate links are not required.

Logical configuration object for a switch interface on a managed FortiSwitch, holding native VLAN, allowed VLANs, STP settings, PoE state, and security features. Ports are edited through the FortiGate when the switch is FortiLink-managed.

Time-based profile that controls when Power over Ethernet is delivered on FortiSwitch ports, letting you power down access points or cameras outside business hours to save energy and reduce exposure.

Layer 2 loop-prevention protocol that elects a root bridge and blocks redundant paths. On FortiSwitch it must align with FortiGate expectations; mismatched or disabled STP on uplinks commonly produces broadcast storms.

Link Layer Discovery Protocol exchanges identity and capability information between neighboring devices. FortiGate and FortiSwitch use it to advertise management addresses, port descriptions, and PoE capabilities, aiding discovery and topology mapping.

Fortinet wireless access point that can be managed by a FortiGate, FortiLAN Cloud, or a dedicated controller. It broadcasts SSIDs, enforces wireless security, and tunnels or bridges client traffic according to its profile.

FortiOS module that discovers, authorizes, and configures FortiAP units, assigns profiles and SSIDs, and monitors wireless clients. It lives alongside the Switch Controller under WiFi & Switch Controller.

Reusable configuration template applied to FortiAP units that defines radio settings, SSID bindings, channel and power behavior, and tunneling mode. One profile can serve many access points.

Service Set Identifier, the network name clients see and select when joining a wireless LAN. On FortiOS an SSID is defined together with its security mode, VLAN, and traffic handling before being mapped to a VAP.

Virtual Access Point: the FortiOS object that binds an SSID to a FortiAP profile, radio, VLAN, and security policy so the SSID is actually broadcast. Multiple VAPs on one radio provide separate networks.

FortiAP traffic handling where client traffic is encapsulated to the FortiGate, typically over CAPWAP, and inspected by firewall policies before leaving. It centralizes security but adds a tunnel path for all client data.

FortiAP traffic handling where client traffic is bridged locally onto the wired VLAN at the access point instead of being tunneled to the FortiGate. It reduces controller load but moves policy enforcement to the edge.

Control and Provisioning of Wireless Access Points: the protocol carrying control messages and, in tunnel mode, client data between FortiAP and FortiGate. Blocked CAPWAP ports are a frequent reason an AP never comes online.

Current Wi-Fi security standard offering stronger handshakes and protection of unencrypted traffic. FortiAP profiles can select WPA3 personal or enterprise modes, sometimes alongside WPA2 for client compatibility.

Port-based access control standard that authenticates a supplicant through an authenticator to a RADIUS server before granting network access. Used on both wired FortiSwitch ports and wireless SSIDs.

AAA protocol FortiOS uses to send user credentials and receive authorization decisions from servers such as FortiAuthenticator or Windows NPS. It underpins enterprise Wi-Fi and wired 802.1X deployments.

Fortinet network access control product that discovers and profiles devices, enforces admission policy, and can quarantine or remediate endpoints. It integrates with FortiSwitch and FortiAP to apply dynamic VLANs and access rules.

VLAN assignment made at connection time based on authentication or device identity rather than fixed port configuration. FortiSwitch and FortiAP can place a user into a VLAN returned by RADIUS or assigned by FortiNAC.

Switch security feature that inspects DHCP messages and blocks unauthorized DHCP servers on untrusted ports. It builds a binding table used by related protections such as dynamic ARP inspection and IP source guard.

Switch protection that validates ARP packets against the DHCP snooping binding table, dropping spoofed replies that would otherwise enable man-in-the-middle attacks on the local segment.

FortiSwitch feature limiting which and how many MAC addresses may appear on a port, with actions such as block or shutdown when violated. It curbs unauthorized devices and MAC flooding.

Protection that detects a port unexpectedly receiving its own BPDUs, indicating a loop, and then blocks or errs the port. It complements spanning tree on edge ports where loops are most likely.

The FortiGate-side role that authorizes FortiSwitch units, pushes VLAN and port configuration, and monitors switch health over FortiLink. It is the central point for LAN Edge wired management.

State in which a managed FortiSwitch or FortiAP runs the firmware version the FortiGate expects. Noncompliant devices are flagged and may be upgraded or held back until versions match.

A FortiSwitch or FortiAP explicitly approved on the FortiGate before it can join the managed topology. Unauthorized devices are discovered but denied service, preventing rogue hardware from joining.

An unauthorized access point detected on the wireless medium, often impersonating a legitimate SSID. FortiAP radios can classify and, where permitted, contain rogue devices.

Detection of malicious or policy-violating wireless activity such as evil-twin SSIDs, deauthentication floods, or ad-hoc networks. FortiAP sensors report these events to the FortiGate for logging and response.

Firewall policy governing traffic from wired and wireless LAN Edge segments, applying security profiles and logging. Policies reference VLAN interfaces created for FortiSwitch and FortiAP networks.

Logical FortiGate interface carrying one VLAN's traffic, used as the gateway for that segment and as the source or destination in firewall policies. FortiLink VLANs and wireless VLANs are typically represented this way.

Day-to-day operation of the FortiOS device covering administrators, profiles, interfaces, routing, and logging. On LAN Edge deployments it is the control plane for both switch and wireless management.

FortiOS object granting an administrator account specific read-write permissions over areas such as switch controller or wireless controller. Least-privilege profiles limit accidental or malicious changes.

FortiOS CLI command family that enables real-time debug output for processes such as CAPWAP, FortiLink, or 802.1X. It is a primary tool for troubleshooting why a device or client fails to connect.

FortiOS subsystem that records events and traffic from LAN Edge devices and generates reports. Wireless client association failures, switch port changes, and rogue detections all surface here for investigation.