LAN Edge Fundamentals and FortiOS 7.6 Administration
Domain 1: LAN Edge fundamentals and FortiOS 7.6 administration
This domain tests how FortiOS 7.6 on a FortiGate acts as the controller and policy point for FortiSwitch and FortiAP devices. Expect questions on FortiLink, CAPWAP, administrative scoping, and the order in which devices become managed.
Core rules
- FortiLink is the FortiGate–FortiSwitch management and control channel. FortiAPs use CAPWAP control and data channels; DTLS protects the control channel when enabled.
- A FortiLink interface can be a dedicated physical port, an 802.3ad LAG, or an L3 FortiLink. The switch must be authorized before it appears as managed.
- Administrators, admin profiles, VDOMs, and trusted hosts limit who can change LAN Edge configuration. Firmware and configuration backup are part of administration.
- FortiGate provides DHCP, DNS, routing, NTP, and FortiGuard services used by switches and APs. NTP accuracy matters for certificates and logs.
- FortiSwitch discovery uses FortiLink/LLDP; FortiAP discovery can use DHCP option 138, DNS, or broadcast. DHCP option 138 is a common exam point.
Worked example
A FortiGate must manage one FortiSwitch and one FortiAP. Create a dedicated FortiLink interface, connect the switch, authorize it, then define VLANs 10 and 20 on the FortiGate. Assign the switch port native VLAN 10 and allowed VLAN 20. Create an SSID in tunnel mode mapped to VLAN 20, attach a FortiAP profile, and authorize the AP. The AP gets an IP from DHCP, discovers the controller, and forms CAPWAP. Client traffic on VLAN 20 reaches the FortiGate because the SSID is tunneled; a firewall policy from VLAN 20 to WAN is still required.
Traps
- Assuming a managed FortiSwitch needs its VLANs configured only in standalone CLI; managed VLANs are driven from the FortiGate.
- Confusing native (untagged) and allowed (tagged) VLANs.
- Forgetting authorization, so the device stays in the discovered list.
- Scoping objects to the wrong VDOM, or using an admin profile that blocks switch/AP configuration.
- Mixing incompatible FortiSwitch or FortiAP firmware with FortiOS 7.6.