FortiSwitch Deployment and Management
Domain 2: FortiSwitch deployment and management
This domain focuses on provisioning FortiSwitch in standalone and FortiLink-managed modes, and on port, VLAN, link, and power behavior.
Core rules
- A managed FortiSwitch receives configuration from the FortiGate over FortiLink. Standalone mode uses the switch's own CLI/GUI and does not get FortiGate port profiles.
- FortiSwitch profiles define port settings: native VLAN, allowed VLANs, PoE, STP, LLDP, QoS, and security. A profile is applied to ports; the VLANs must exist on the FortiGate.
- The native VLAN is sent untagged; allowed VLANs are sent tagged. If a VLAN is not in the allowed list, tagged frames for it are dropped.
- FortiLink LAG uses 802.3ad to bundle uplinks. MCLAG provides dual-homed redundancy and requires coordinated FortiLink and peer-link configuration. Spanning tree, loop guard, and BPDU guard protect against loops.
- PoE budget is per switch model; adding powered devices beyond budget causes denial. Firmware upgrades are scheduled from the FortiGate for managed switches.
Worked example
An access switch connects a PC and an IP phone. The PC must use VLAN 10 untagged; the phone uses VLAN 20 tagged, with voice traffic marked. On the FortiGate, create VLAN 10 and VLAN 20 on the FortiLink interface. In the FortiSwitch port profile, set native VLAN 10 and allowed VLANs 10 and 20. The PC's untagged frames land in VLAN 10; the phone tags its voice frames with VLAN 20. If VLAN 20 is omitted from allowed VLANs, the phone registers but voice fails. If the native VLAN is left as default, the PC lands in the wrong subnet and DHCP fails.
Traps
- Configuring the VLAN only on the switch, not on the FortiGate.
- Reversing native and allowed VLAN roles.
- Forgetting that a FortiLink LAG needs matching member ports and no conflicting STP settings.
- Overlooking PoE class and budget when adding APs or cameras.
- Upgrading switch firmware without checking the FortiOS 7.6 compatibility matrix.