Author: Mark Davis, FCSS & Fortinet NSE 7 Certified

Last updated on: Mar 04, 2026

Mark is a Lead Network Security Architect with over 12 years of experience deploying unified threat management systems and extending secure access edge architectures. Holding the prestigious Fortinet Certified Solution Specialist (FCSS) designation, he specializes in FortiSwitch, FortiAP, and deeply integrated Fortinet Security Fabric deployments.

Question 1: FortiLink Management

An administrator is connecting a new factory-default FortiSwitch to a FortiGate. The administrator has configured a FortiLink interface on the FortiGate with the “Auto-Authorize” feature disabled. Which protocol does the FortiSwitch use to discover the FortiGate and request authorization?

A. SNMPv3
B. CAPWAP
C. FortiTelemetry
D. LLDP-MED

Answer: B

Explanation: In FortiLink mode, FortiSwitch discovery and management rely on CAPWAP (Control and Provisioning of Wireless Access Points), the same protocol Fortinet uses to manage FortiAPs. When the switch boots up, it broadcasts discovery requests. Once the FortiGate receives the request over the FortiLink interface, the administrator must manually authorize the switch (since auto-authorize is disabled) to establish the secure CAPWAP management tunnel.

Question 2: Layer 2 High Availability (MCLAG)

Two FortiSwitches are configured as an MCLAG peer group to provide redundant connectivity to a downstream ESXi host. What is the purpose of the Inter-Switch Link (ISL) between the two FortiSwitches in this topology?

A. It is used exclusively as a keepalive heartbeat to prevent split-brain scenarios.
B. It routes Layer 3 traffic between the OSPF domains of the two switches.
C. It synchronizes MAC address tables, IGMP snooping tables, and carries data traffic if a downstream link fails.
D. It serves as the primary CAPWAP tunnel connection back to the FortiGate.

Answer: C

Explanation: In a Multi-Chassis Link Aggregation (MCLAG) architecture, the Inter-Switch Link (ISL) is a critical component. It connects the two peer FortiSwitches and acts as both a control plane and a data plane trunk. Control plane traffic over the ISL synchronizes MAC addresses and operational states so both switches act as a single logical entity. Additionally, if an active link to the downstream host fails on one switch, the ISL forwards the data traffic to the surviving peer to ensure seamless delivery.

Question 3: Port Security & 802.1x

You want to dynamically assign a VLAN to a user’s workstation based on their Active Directory group membership when they plug into a managed FortiSwitch port. How is this dynamically assigned VLAN communicated to the FortiSwitch during the authentication process?

A. The FortiGate inspects the user’s kerberos ticket and pushes a CLI command to the switch.
B. The RADIUS server returns the ‘Tunnel-Private-Group-Id’ attribute in the Access-Accept message.
C. The FortiSwitch uses LLDP to query the workstation’s domain controller.
D. The user must manually select their VLAN from a captive portal page.

Answer: B

Explanation: Dynamic VLAN assignment relies on 802.1x port-based authentication paired with a RADIUS server (such as FortiAuthenticator or Windows NPS). When the user authenticates, the RADIUS server evaluates their AD group. If successful, it sends an ‘Access-Accept’ packet back to the authenticator (the FortiSwitch/FortiGate) containing specific IETF RADIUS attributes, most importantly the Tunnel-Private-Group-Id attribute, which contains the VLAN ID or VLAN name the port should be dynamically assigned to.

Question 4: Spanning Tree Protocol (STP)

A network engineer is reviewing the Spanning Tree Protocol (STP) configuration on a network of FortiSwitches managed by a FortiGate via FortiLink. By default, how does Fortinet handle STP in a FortiLink managed environment?

A. STP is permanently disabled on all FortiLink interfaces to allow routing.
B. The FortiGate firewall acts as the STP Root Bridge for the entire Layer 2 domain.
C. FortiSwitches run STP natively (usually MSTP by default), and the FortiGate does not participate in the STP topology.
D. FortiSwitch uses Cisco’s proprietary PVST+ by default for wider compatibility.

Answer: C

Explanation: In a FortiLink managed environment, the FortiGate acts as the Layer 3 gateway and management controller, but it does not participate in the Layer 2 Spanning Tree topology. The managed FortiSwitches run STP natively among themselves to prevent Layer 2 loops. By default, FortiSwitch utilizes Multiple Spanning Tree Protocol (MSTP). The FortiGate simply pushes the STP configuration profiles down to the switches.

Question 5: Layer 3 FortiLink Architectures

You are deploying a FortiSwitch at a remote branch office. The switch must be managed by the central headquarters FortiGate over an IPsec VPN tunnel (Layer 3 network). Which configuration step is mandatory on the FortiSwitch to establish the FortiLink connection over a routed network?

A. The FortiSwitch must be configured with a static IP address and the FortiGate’s IP address must be set as the AC (Access Controller) controller.
B. The FortiGate must use a dedicated VXLAN tunnel for the FortiLink interface.
C. The FortiSwitch must be flashed with a special Layer-3 firmware image.
D. You must enable BGP on the FortiSwitch management interface.

Answer: A

Explanation: While FortiLink discovery is automatic over a direct Layer 2 connection (via broadcast), establishing FortiLink over a Layer 3 routed network (such as over an IPsec VPN to a remote branch) requires the switch to know where the controller (FortiGate) resides. This can be achieved by either using DHCP Option 138 on the local DHCP server or manually configuring the FortiSwitch CLI to set the FortiGate’s IP address as its Access Controller (AC).