Tail-drop is a queue management algorithm used for congestion avoidance. When an egress port's queue buffer becomes full (congested), the FortiSwitch will discard any new incoming packets destined for that queue. This process of dropping all subsequent packets continues until packets are transmitted from the queue, freeing up buffer space. This behavior directly matches the scenario described in the question, where incoming packets are dropped until congestion on the egress port is relieved.

B. Weighted round robin mode: This is a packet scheduling algorithm that allocates egress port bandwidth among different traffic queues based on configured weights, not a policy for dropping packets during congestion.

C. Random early detection mode: This is a proactive congestion avoidance mechanism that starts dropping packets probabilistically before a queue becomes completely full, aiming to prevent total congestion. It does not wait for the queue to be full.

D. Strict mode: This is a priority-based packet scheduling algorithm that services the highest-priority queue exclusively until it is empty before servicing any lower-priority queues. It is not a drop policy.

1. Fortinet FortiSwitchOS 7.4.0 Administration Guide, Page 138, "Configuring QoS".

The guide describes the two available drop policy modes. For Tail-drop mode, it states: "When the queue is full, the incoming packet is dropped. This is the default mode." This confirms the behavior described in the question.

2. Fortinet FortiSwitchOS 7.4.0 CLI Reference, Page 378, config switch qos drop-policy.

This section details the CLI commands for QoS drop policies. It lists the two available modes for set mode: taildrop and red. The description for taildrop implicitly defines its function as dropping packets when the queue limit is reached.

3. Fortinet FortiSwitchOS 7.4.0 Administration Guide, Page 138, "Configuring QoS".

The guide distinguishes between drop policies and queue (scheduling) policies. It describes "Strict mode" and "Weighted round-robin mode" under the config switch qos queue-policy section, confirming they are for scheduling egress traffic, not for dropping packets due to congestion.

A FortiSwitch Access Control List (ACL) can process traffic that matches its rules in several ways. Two fundamental actions are dropping the traffic and redirecting it. The deny action explicitly instructs the FortiSwitch to discard the matching frames, preventing them from being forwarded. The mirror action sends a copy of the matching frames to a specified port, which is a form of redirection used for traffic analysis or monitoring. Both deny (drop) and mirror (redirect) are configurable actions directly within a FortiSwitch ingress ACL entry.

B. Assign traffic to a high-priority egress queue. This is a Quality of Service (QoS) function. While an ACL is used to classify traffic for a QoS policy, the ACL action itself is permit; the queue assignment is configured separately in the QoS policy that references the ACL.

C. Encrypt frames. Frame encryption is handled by specific security protocols like MACsec, which is configured on a per-port basis and is not a direct action available within a standard FortiSwitch ACL rule.

1. FortiSwitchOS 7.6.0 Administration Guide, Page 111, "Configuring an IPv4 ACL".

The guide details the CLI commands for configuring an ingress ACL. Under the config entries section for an ACL, the set action command is shown with the available parameters: set action {deny | permit | mirror}.

deny corresponds to option D (Drop frames).

mirror corresponds to option A (Redirect frames to another port, specifically for monitoring purposes).

2. FortiSwitch 7.6.0 Security Guide, Page 21, "Access control lists".

This document also confirms the available actions for ingress ACLs: "The following actions are available for ingress ACLs: permit, deny, mirror." This reinforces that dropping (deny) and redirecting/copying (mirror) are valid actions, while queue assignment and encryption are not direct ACL actions.

When untagged traffic arrives at FortiSwitch port1, the switch determines VLAN assignment based on configured policies. PC1's MAC address is explicitly configured as a member of VLAN 10 via MAC-based VLAN assignment, which overrides the port's native VLAN. Consequently, PC1's traffic is assigned to VLAN 10. PC2 lacks a specific MAC-based policy; thus, its untagged traffic defaults to port1's Native VLAN, which is VLAN 20. Upon egressing port2 towards the FortiGate, the traffic must be forwarded. Port2 is configured with Allowed VLANs 10 and 20, but neither is configured as an Untagged VLAN or the Native VLAN (4094) for that port. Therefore, FortiSwitch applies an 802.1Q tag corresponding to the assigned VLAN for each frame: VLAN 10 for PC1 and VLAN 20 for PC2.

A. Incorrect because MAC-based VLAN assignment intercepts PC1's traffic and places it into VLAN 10, preventing it from defaulting to the Native VLAN 20 alongside PC2.

B. Incorrect because PC2's MAC address is not mapped to VLAN 10; MAC-based overrides apply strictly to the specific MAC addresses defined in the policy.

D. Incorrect because egress port2 does not have VLAN 10 listed under Untagged VLANs, nor is it the native VLAN, so PC1 traffic must be tagged upon egress.

Fortinet, Inc. "FortiSwitchOS 7.2.0 Administration Guide." MAC-based VLANs, Document Identifier: 01-720-781523-20220804, pp. 154-156. (Details how MAC-to-VLAN binding supersedes standard port-based Native VLAN assignment for ingress traffic).

Fortinet, Inc. "FortiSwitchOS 7.2.0 Administration Guide." VLANs and port configuration, Document Identifier: 01-720-781523-20220804, pp. 148-151. (Specifies that egressing traffic on allowed VLANs receives an 802.1Q tag unless specifically defined in the port's untagged-vlans list or matched to the native VLAN).

A Routed VLAN Interface (RVI) is created on a FortiSwitch when a physical port or a trunk is configured with an IP address, effectively converting it into a Layer 3 interface. During this process, FortiSwitch OS automatically assigns the interface to an internal, reserved VLAN, which is VLAN 4095. This dedicated VLAN is used internally by the switch to handle the Layer 3 routing functions for that specific port or trunk. The port is no longer a simple Layer 2 port and can participate in IP routing.

A. VLAN 1 is the default native VLAN for trunks, not a management VLAN automatically assigned when creating a specific Layer 3 routed port.

C. An RVI makes the port a Layer 3 interface. While it can be configured on a trunk, this statement incorrectly describes the primary function and effect of creating an RVI.

D. The port does become a Layer 3 interface, but the internal VLAN assigned for routing purposes is VLAN 4095, not VLAN 1.

1. Fortinet. (2024). FortiSwitch OS 7.6.0 Administration Guide. Fortinet Document Library. Page 129.

In the "Layer 3 > Routed VLAN interface" section, it states: "A routed VLAN interface (RVI) is a layer-3 interface that is automatically assigned to VLAN 4095. You can assign an IP address to an RVI and enable it for routing... When you configure an IP address on a physical port, the port becomes an RVI." This directly confirms that the port becomes a Layer 3 interface and is assigned to VLAN 4095.

A primary application of a quarantine VLAN is to isolate devices that fail security checks, such as 802.1X authentication. When a device attempts to connect to a port configured with an 802.1X policy and fails the Extensible Authentication Protocol (EAP) exchange, the FortiSwitch can be configured to dynamically move that port to a pre-defined quarantine VLAN. This action effectively isolates the non-compliant device from the production network while allowing it limited access, typically to remediation services hosted on the FortiGate. This is a fundamental feature of Fortinet's Network Access Control (NAC) solution.

A. A quarantine VLAN is typically configured on the FortiGate with a DHCP server to assign an IP address for remediation portal access.

C. Using a quarantine VLAN is an action configured within a specific NAC or 802.1X policy; it is not exclusively dependent on a single global setting.

D. The quarantine VLAN must be explicitly added to the allowed-vlans list on the FortiLink trunk to permit traffic between the quarantined device and the FortiGate.

1. FortiOS 7.6.0 Handbook, FortiSwitch Manager, "Configuring 802.1X security policies" section: This section details the configuration of 802.1X policies, including the action to take upon authentication failure. It states, "If you enable set eap-fail-vlan enable, you can select a VLAN to assign to clients that fail EAP authentication." This directly supports the correct answer (B).

2. FortiSwitch 7.6.0 CLI Reference, config switch-controller security-policy 802-1X command: The documentation for this command includes the set eap-fail-vlan {enable | disable} and set eap-fail-vlan-id parameters. These options explicitly provide the functionality to assign a specific VLAN when 802.1X authentication fails, confirming the mechanism described in answer B.

3. FortiOS 7.6.0 Handbook, FortiSwitch Manager, "Configuring NAC policies" section: When describing the "Quarantine" action for a NAC policy, the guide explains that the device can be assigned to a specific VLAN. It also shows that for this to work, a VLAN interface with a DHCP server must be configured on the FortiGate and the VLAN must be allowed on the FortiLink trunk, which refutes options A and D.

The debug output captures the FortiLink protocol (FLP) state transitions and keepalive mechanisms between FortiSwitch and FortiGate. The transition from FL_STATE_WAIT_JOIN to FL_STATE_READY demonstrates that the switch has been successfully discovered and authorized by the FortiGate, rendering it fully operational. Once authorized and in the READY state, the switch begins sending keepalive messages. The flp_send_pkt log entries showing type(5) packets transmitted exactly three seconds apart (at 12:13:21 and 12:13:24) represent FortiLink heartbeats. These heartbeats are standard functionality, sent from the managed FortiSwitch to the FortiGate controller to maintain the connection status and confirm ongoing availability.

C. The switch is no longer waiting; it successfully transitioned from FL_STATE_WAIT_JOIN to FL_STATE_READY, confirming it has already joined the stack group and is fully authorized.

D. The output displays state transitions and heartbeat (Type 5) packet transmissions; it contains no logs or protocol events related to hostname configuration or pushing hostname updates.

Fortinet, "NSE 6 - FortiSwitch 7.2 Administrator Study Guide", Chapter: FortiLink, Section: Troubleshooting and Debugging FortiLink, p. 410.

Fortinet, "FortiOS 7.2.0 Administration Guide", Document ID: FT-FOS-72-Admin, Section: Switch Controller -> FortiLink Operation and Packet Types.

To enable SNMP version 2c (SNMPv2c) on a managed FortiSwitch, you must first enable the SNMP agent on the device. For SNMPv2c, access control and authentication are managed through community strings. Therefore, you must create and configure at least one SNMP community. This community defines the password (community string), the IP addresses of the SNMP managers allowed to query the agent, and the type of access (read-only or read-write). This configuration is performed on the managing FortiGate controller.

A. SNMP users, which involve authentication and encryption settings, are a requirement for the SNMPv3 protocol, not for the simpler community-based SNMPv2c.

B. Specifying an SNMP host to send traps to is an optional configuration for sending asynchronous alerts; it is not a requirement to enable the SNMP agent for polling.

C. SNMPv3 is a distinct and more secure version of the protocol. It is not required, nor is it used, to handle SNMPv2c messages or traps.

1. FortiSwitch Manager 7.6.0 Administration Guide:

Page 100, "Configuring SNMP for a managed FortiSwitch": This section details the process. It explicitly shows that for SNMPv1/v2c, you must create an "SNMP Community," which involves setting the community name and hosts. This directly supports the requirement to configure communities.

2. FortiOS 7.6.0 Administration Guide:

Page 111, "SNMP": This section describes the SNMP configuration within FortiOS, which is used to manage the FortiSwitch. It clearly distinguishes between creating "Communities" for SNMPv1/v2c and creating "Users" for SNMPv3. It states, "To add an SNMP community, select Create New in the SNMP v1/v2c section." This confirms that configuring communities is the correct procedure for SNMPv2c.

In a FortiGate multi-tenancy configuration managing FortiSwitches, there are two primary methods to assign switch ports to a specific Virtual Domain (VDOM).

1. VLAN-to-VDOM Mapping: You can create a VLAN interface on the FortiLink aggregate interface within the managing VDOM (e.g., root). This VLAN interface is then assigned to a specific tenant VDOM. Subsequently, you assign physical FortiSwitch ports to this VLAN, which effectively directs all traffic from those ports to the designated tenant VDOM.

2. Virtual Port Pool: This feature is designed specifically for multi-tenancy. A global administrator creates a pool of FortiSwitch ports and assigns this entire pool to a tenant VDOM. The administrator of that VDOM can then manage and configure the ports within their assigned pool.

C. VDOM configuration is a FortiGate function. A managed FortiSwitch receives its configuration, including port assignments, from the FortiGate controller and cannot be configured directly with VDOMs.

D. The FortiLink interface itself is the management channel and must reside in the VDOM managing the FortiSwitch. Moving it to a tenant VDOM would break the management connection.

1. Fortinet FortiOS 7.6.0 Administration Guide, FortiSwitch Manager > Multi-tenancy (VDOMs), Page 1. This section explicitly states: "There are two ways to assign a FortiSwitch port to a VDOM: Create a virtual port pool... Assign a VLAN to a VDOM..."

2. Fortinet FortiSwitch Manager 7.6.0 Administration Guide, Multi-tenancy (VDOMs) > Assigning a VLAN to a VDOM. This section details the procedure: "You can assign a VLAN to a VDOM and then assign FortiSwitch ports to that VLAN."

3. Fortinet FortiSwitch Manager 7.6.0 Administration Guide, Multi-tenancy (VDOMs) > Creating a virtual port pool. This section describes the alternative method: "You can create a virtual port pool and then assign the virtual port pool to a VDOM."

4. Fortinet CLI Reference - FortiOS 7.6.0, config switch-controller virtual-port-pool. This command reference details the CLI structure for creating and managing virtual port pools for VDOM assignment.

In a Fortinet Multi-Chassis Link Aggregation Group (MCLAG) configuration, the peer switches are designed to operate as a single logical switch from the perspective of downstream devices and the Spanning Tree Protocol (STP). To achieve this, the MCLAG primary switch synchronizes its Bridge MAC address and STP priority with the secondary switch. Consequently, both Core-1 and Core-2 share the exact same Bridge ID (Priority 20480 and MAC 02090f000701, as seen in the exhibits). Because they represent a single logical entity in the MSTP topology with the lowest shared bridge ID, both devices correctly report themselves as the root bridge.

A. FortiGate firewalls typically do not participate in switch-level STP. Furthermore, external participation would not cause two distinct switches to share an identical Bridge MAC address.

B. An incorrectly configured ISL would likely cause a split-brain scenario, but the exhibits explicitly show synchronized identical Bridge MACs, confirming proper logical operation, not an inconsistency.

D. The provided CLI exhibits clearly display active MSTP instance parameters, such as Forward Time and Max Age, directly contradicting the assertion that MCLAG automatically disables STP.

Fortinet, Inc. FortiSwitchOS Administration Guide. "Multi-chassis link aggregation groups (MCLAG)" -> "MCLAG and spanning tree protocol (STP)". The documentation specifies that "the MCLAG peer group acts as a single STP node. Both MCLAG peer switches share the same bridge ID."

When DHCP snooping is enabled on a VLAN, the switch acts as a layer 2 firewall between untrusted hosts and valid DHCP servers. Client-facing ports are designated as untrusted, while ports connected to legitimate DHCP servers must be designated as trusted. When an untrusted port receives a DHCP broadcast (such as a DISCOVER message) from a client, the switch intercepts the packet and forwards it exclusively to the configured trusted ports. Because the Linux-Server is acting as the DHCP server, its connected switch port (port4) must be trusted. If port4 is left untrusted, the switch will not forward the client's DHCP broadcasts to it, resulting in the server receiving no DHCP traffic.

A. The scenario explicitly states this is intra-VLAN traffic and tcpdump confirms broadcasts, indicating the client is successfully broadcasting on the established Student VLAN.

B. Port1 connects to the Linux-Client, so it must remain untrusted. An untrusted client port successfully accepts DHCP discovery broadcasts to forward to trusted ports.

D. The FortiSwitch port table demonstrates that the Native VLAN on port1 is already configured as "Student," meaning untagged traffic is natively placed on this VLAN.

Fortinet Document Library: FortiSwitchOS 7.2 Administration Guide. "Layer 2 Security: DHCP Snooping." (Details the default untrusted state of ports and the requirement to configure trusted ports for DHCP servers to receive forwarded requests).

Fortinet Knowledge Base (Technical Note): "Technical Tip: How to configure DHCP snooping." (Confirms that DHCP DISCOVER packets received on an untrusted port are only forwarded to trusted ports).

IEEE/IETF RFC Documentation: IETF RFC 3046 "DHCP Relay Agent Information Option" / Core DHCP Snooping Principles. (Outlines the fundamental mechanism of trusted versus untrusted network segments for DHCP traffic handling).