The FortiLink authorization process is an integral part of setting up FortiSwitch to be managed by

FortiGate. The correct statements regarding the FortiLink authorization process are:

C . A FortiLink frame is sent by FortiGate to FortiSwitch to complete the authorization. This is a part

of the FortiLink protocol, where FortiGate communicates with the connected FortiSwitch to establish

management and control. This frame initiates the configuration and management process, allowing

FortiGate to effectively control the switch.

D . FortiLink authorization sets the FortiSwitch management mode to FortiLink. Once authorized, the

management mode of FortiSwitch is set to FortiLink, indicating that it is being managed via a

FortiLink connection from a FortiGate appliance. This changes the operational mode of the switch to

be under the control of the FortiGate for centralized management and policy application.

Reference:

Further details on the FortiLink setup and authorization process can be accessed through the

FortiGate configuration guides available on the Fortinet Documentation site.

In a multi-tenancy setup on FortiGate, you can assign a FortiSwitch port to a VDOM in two primary

ways:

Switch the FortiLink Interface to the Target VDOM (A): This method involves configuring the FortiLink

interface, which is the dedicated interface used to manage FortiSwitch units from FortiGate, to

operate within a specific VDOM. This effectively assigns all ports on the FortiSwitch, managed

through that FortiLink interface, to the designated VDOM.

Create a Virtual Port Pool on the FortiGate CLI (C): Virtual port pools are created on FortiGate and

allow ports from FortiSwitch to be grouped and assigned to a VDOM. This method is more granular

and flexible, as it allows specific ports on the FortiSwitch to be dedicated to different VDOMs without

requiring the entire switch or FortiLink interface to be dedicated to a single VDOM.

The 'by VLAN redirect MAC address quarantine' mode and the 'by redirect MAC address quarantine'

mode on FortiGate share specific similarities:

Quarantine VLAN Assignment (A):

Common Feature: Both modes utilize a designated quarantine VLAN to isolate quarantined devices.

This helps in mitigating the risk of spreading potential security threats within the network.

Operational Impact: Moving devices to a specific quarantine VLAN restricts their network access,

effectively isolating them until further action or remediation is taken.

The two reasons why port1 can be shut down are loop guard protection and Spanning Tree Protocol

(STP).

Loop guard protection: This is a feature that helps to prevent switching loops in a

network.expand_more A loop guard can be configured on a port to monitor for specific traffic

patterns that indicate a loop. If loop guard protection detects a loop, it will shut down the port to

prevent the loop from causing problems.

STP: STP is a protocol that helps to prevent switching loops.expand_more When multiple paths exist

between two network devices, STP will block all but one of the paths, creating a loop-free

topology.expand_more If STP detects a loop, it will shut down the ports that are involved in the loop.

In the exhibit, both ports 1 and 2 are configured with the same native VLAN 10. This configuration

could create a switching loop if both ports are connected to devices on the same network segment. If

a loop occurs, loop guard protection or STP could shut down port1 to prevent the loop from causing

problems.

Reference:

Fortinet FortiSwitch 7.2 Administration Guide

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/954635/getting-started

The STP (Spanning Tree Protocol) discarding state on port1 of Core-2, after Core-1 and Access-1 are

managed and authorized by FortiGate-1, is likely due to the lack of an MCLAG (Multi-Chassis Link

Aggregation Group) configuration between Core-1 and Core-2. In typical network configurations

involving STP and MCLAG, the absence of MCLAG can lead to STP blocking one of the redundant

paths to prevent loops, which is a critical function of STP. Port1 on Core-2 being in a discarding state

suggests that it has been identified as providing a redundant path that could potentially create a

network loop, hence STP has placed this port in a blocking (discarding) state to maintain a loop-free

topology.

Reference:

For a deeper understanding of STP operations and MCLAG configurations in FortiGate managed

environments, consult the Fortinet knowledge base: Fortinet Knowledge Base.