Mastering Fortinet FortiSwitch for Network Professionals

config  system vdom-dns

set  vdom-dns enable

set  primary  1.1.1.1

set  primary  8.8.8.8

10.10.10.254/24 = Office LAN = Office Zone

10.10.20.254/24 = Office Wireless = Office Zone

10.10.30.254/24 = IT LAN = Office Zone

10.10.40.254/24 = IT Wireless = Office Zone

10.10.50.254/24 = Windows Servers = Servers Zone

10.10.60.254/24 = Linux Servers = Servers Zone

10.10.70.254/24 = Legacy = Legacy Zone

10.10.80.254/24 = Guest Wireless = Guest Zone

10.10.200.254/24 = MGTM VLAN

config switch interface

edit <port>

set auto-discovery-fortilink enable

end

To display flap-guard information for all ports of a FortiSwitch unit:

diagnose switch-controller switch-info flapguard status S224EPTF22002817

To reset a port:

execute switch-controller flapguard reset  S224EPTF22002817 port4

When inter-switch links (ISLs) are automatically formed on trunks, the switch controller allows VLANs 1-4093 on ISL ports. This configuration can increase data processing on the FortiSwitch unit. When VLAN optimization is enabled, the FortiSwitch unit allows only user-defined VLANs on the automatically generated trunks.

NOTE: VLAN optimization is enabled by default.

To enable FortiLink VLAN optimization on FortiSwitch units from the FortiGate unit:

config switch-controller global

set vlan-optimization enable

end

NOTE: You cannot use the set vlan-all-mode all command with the set vlan-optimization enable command.

config switch-controller managed-switch

edit S524DF4K15000024

config ports

edit port3

set learning-limit 50

next

end

end

end

config switch-controller global

set mac-violation-timer <0-1500>

set log-mac-limit-violations {enable | disable}

end

• diagnose switch-controller switch-info mac-limit-violations all <FortiSwitch_serial_number>

• diagnose switch-controller switch-info mac-limit-violations interface <FortiSwitch_serial_number> <port_name>

• diagnose switch-controller switch-info mac-limit-violations vlan <FortiSwitch_serial_number> <VLAN_ID>

• execute switch-controller mac-limit-violation reset all <FortiSwitch_serial_number>

• execute switch-controller mac-limit-violation reset vlan <FortiSwitch_serial_number> <VLAN_ID>

• execute switch-controller mac-limit-violation reset interface <FortiSwitch_serial_number> <port_name>

Persistent (sticky) MAC addresses

You can make dynamically learned MAC addresses persistent when the status of a FortiSwitch port changes (goes down or up). By default, MAC addresses are not persistent.

Use the following commands to configure the persistence of MAC addresses on an interface:

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

config ports

edit <port_name>

set sticky-mac {enable | disable}

next

end

You can also save persistent MAC addresses to the FortiSwitch configuration file so that they are automatically loaded when the FortiSwitch unit is rebooted. By default, persistent entries are lost when a FortiSwitch unit is rebooted. Use the following commands to save persistent MAC addresses for a specific interface or all interfaces:

execute switch-controller switch-action sticky-mac save interface <FortiSwitch_serial_number> <port_name>

execute switch-controller switch-action sticky-mac save all <FortiSwitch_serial_number>

Use one of the following commands to delete the persistent MAC addresses instead of saving them in the FortiSwitch configuration file:

execute switch-controller switch-actionex sticky-mac delete-unsaved all <FortiSwitch_serial_number>

execute switch-controller switch-action sticky-mac delete-unsaved interface <FortiSwitch_serial_number> <port_name>

config switch-controller storm-control

set rate <rate>

set unknown-unicast {enable | disable}

set unknown-multicast {enable | disable}

set broadcast {enable | disable}

end

config switch-controller storm-control-policy

edit <storm_control_policy_name>

set description <description_of_the_storm_control_policy>

set storm-control-mode override

set rate <1-10000000 or 0 to drop all packets>

set unknown-unicast {enable | disable}

set unknown-multicast {enable | disable}

set broadcast {enable | disable}

next

end

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

config ports

edit port5

set storm-control-policy <storm_control_policy_name>

next

end

Starting in FortiOS 7.2.0 with FortiSwitchOS 7.2.0, administrators can use the FortiSwitch profile to control whether users can log in with the managed FortiSwitchOS console port. By default, users can log in with the managed FortiSwitchOS console port.

To change the FortiSwitch profile:

config switch-controller switch-profile

edit {default | <FortiSwitch_profile_name>}

set login {enable | disable} enabled by default

end

To disable logging in to the managed FortiSwitch consort port in the default FortiSwitch profile:

config switch-controller switch-profile

edit default

set login disable

end

To change which FortiSwitch profile is used by a managed switch

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

set switch-profile {default | <FortiSwitch_profile_name>}

end

For example:

config switch-controller managed-switch

edit S524DF4K15000024

set switch-profile new_switch_profile

end

The set allowaccess command configures access to all interfaces on a FortiSwitch unit. If you need to have different access to the FortiSwitch management interface and the FortiSwitch internal interface, you can set up a local-access security policy with the following commands:

config switch-controller security-policy local-access

edit <policy_name>

set mgmt-allowaccess {https | ping | ssh | snmp | http | telnet | radius-acct}

set internal-allowaccess {https | ping | ssh | snmp | http | telnet | radius-acct}

end

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

set access-profile <name_of_policy>

end

For example:

config switch-controller security-policy local-access

edit policy1

set mgmt-allowaccess https ping ssh radius-acct

set internal-allowaccess https ssh snmp telnet

end

config switch-controller managed-switch

edit S524DF4K15000024

set access-profile policy1

end

NOTE: After you upgrade to FortiOS 6.2, the allowaccess settings for the FortiSwitch mgmt and internal interfaces are overridden by the default local-access security policy.

set min-bundle <int>

set max-bundle <int>

set members <port1 port2 ...>

next

end

end

end

Changing the admin password on the FortiGate for all managed FortiSwitch units

By default, each FortiSwitch has an admin account without a password. To replace the admin passwords for all FortiSwitch units managed by a FortiGate, use the following commands from the FortiGate CLI:

see which profile it is using:

config switch-controller managed-switch

edit S524DF4K15000024

show

config switch-controller switch-profile

edit default

set login-passwd-override {enable | disable}

set login-passwd <password>

next

end

If you had already applied a profile with the override enabled and the password set and then decide to remove the admin password, you need to apply a profile with the override enabled and no password set; otherwise, your previously set password will remain in the FortiSwitch. For example:

config switch-controller switch-profile

edit default

set login-passwd-override enable

unset login-passwd

next

end