LAN Edge Security, Integration, and Troubleshooting
Domain 4: LAN Edge security, integration, and troubleshooting
This domain tests how LAN Edge devices integrate with FortiGate security policy and how to isolate faults across wired and wireless paths.
Core rules
- LAN Edge security uses firewall policies, VLAN segmentation, 802.1X, captive portal, device detection, and NAC integration. RADIUS attributes can assign dynamic VLANs.
- FortiSwitch and FortiAP logs, events, and statistics can be sent to FortiAnalyzer, syslog, or SNMP. NTP and certificates must be valid for DTLS and 802.1X.
- Troubleshooting order: physical link and PoE, FortiLink/CAPWAP status, authorization, IP addressing and DHCP, VLAN membership, routing, firewall policy, then authentication.
- Useful diagnostics include FortiLink status, managed-switch and managed-AP lists, DHCP leases, switch-controller and wireless-controller debug commands, and the FortiSwitch/FortiAP CLI.
- Integration with the Security Fabric shares device and client context; without correct VDOM and interface scoping, events and policies may not correlate.
Worked example
Wireless clients associate and receive an IP address but cannot reach the internet. The SSID is tunneled to VLAN 40. Check the FortiAP tunnel status, the VLAN 40 interface, and the DHCP lease. If the lease is correct, check the firewall policy from VLAN 40 to WAN and the default route. If the policy exists, check DNS and RADIUS/authentication logs. If clients instead receive no IP, check DHCP on VLAN 40 and whether the SSID is mapped to the right VLAN. If the SSID were bridged, check the AP uplink's native/allowed VLANs before touching FortiGate policy.
Traps
- Blaming the AP when the FortiLink uplink or switch VLAN is wrong.
- Forgetting a firewall policy for the client VLAN.
- Native/allowed VLAN mismatch on bridged SSIDs.
- RADIUS shared-secret, certificate, or NTP errors that look like wireless failures.
- Troubleshooting in the wrong VDOM or missing that a device is unauthorized.