The described scenario is a classic symptom of a Layer 2 port isolation feature being enabled. When devices on the same VLAN can communicate with their Layer 3 gateway (the FortiGate) but not with each other, it indicates that the switch is intentionally preventing direct host-to-host communication within that broadcast domain. On a FortiGate-managed FortiSwitch, this is achieved by setting the intra-vlan-traffic option to block for the specific VLAN. This security feature forces all traffic to the gateway for inspection, effectively isolating hosts from each other at Layer 2. The term "Access VLAN" in this context refers to a standard access VLAN that has this security policy applied.

B. The FortiSwitch MAC address table is missing entries.

If MAC table entries were missing, the switch would flood unknown unicast frames to all ports in the VLAN, which would still allow communication, not block it.

C. The FortiGate ARP table is missing entries.

The FortiGate's ARP table is for Layer 3 traffic. The problem is at Layer 2 (intra-VLAN), and the fact that FortiGate can ping the devices proves its ARP table is populated.

D. The native VLAN configured on the ports is incorrect.

A native VLAN mismatch would likely cause a complete loss of connectivity for devices on that port, including the inability to ping the FortiGate, which contradicts the problem description.

1. Fortinet FortiOS 7.6.0 CLI Reference:

Under the config switch vlan command context, the security settings include intra-vlan-traffic {allow | block}. The documentation states that setting this to block will "Block traffic between hosts in the same VLAN." This directly corresponds to the behavior observed in the question. (See config switch vlan section).

2. Fortinet Docs - FortiSwitch with FortiLink Guide 7.6.1:

Page 31, "Configuring FortiSwitch VLANs": The guide explicitly states, "You can block traffic between local-port interfaces within the same VLAN." This feature is designed for security and guest networks where you want to prevent clients from communicating directly with each other. This perfectly matches the scenario.