Fortinet black logo

Handbook

Configuring network interfaces

Copy Link
Copy Doc ID 603e8323-b78c-11ec-9fd1-fa163e15d75b:345804
Download PDF

Configuring network interfaces

The network interfaces that are bound to physical ports have three uses:

  • Management—Ports mgmt1 and mgmt2 are management interfaces. Management interfaces are used for administrator connections and to send management traffic, like syslog and SNMP traffic. Typically, administrators use mgmt1 for the management interface, but either or both can be used.
    • HA—If you plan to deploy HA, you must select a physical management port for HA heartbeat and synchronization traffic. Typically, administrators use mgmt2 for the HA interface for direct-connection between appliances, but either can be used, even if in use for administrative access, if both devices have Layer 2 connectivity (not direct-cabled). Please see System > High Availability for settings and HA system requirements .
  • Traffic—The remaining physical port-pairs ports can be used for data traffic — these are "Traffic Ports". The FortiDDoS system is deployed inline (between the Internet and your local network resources). Consecutive odd-even ports belong to port pairs: Use odd port numbers (1, 3, 5, and so on) for the LAN-side connection and even port numbers (2, 4, 6, and so on) for the WAN-side connection. For example, port1 and port2 are a pair. The port1 interface is connected to a switch that connects servers in the local network; the port2 interface is connected to the network path that receives traffic from the Internet.

Note:

  • 1000Base-T/GE copper ports use auto-negotiation to determine the connection speed. No other options are available. All 1000Base-T port-pairs support optional (default) fail-open.

  • LC ports house GE or 10GE optical transceivers, depending on the model. No other speed options are available. All LC port-pairs support optional (default) fail-open.

  • SFP ports support GE SFP (optical or copper) or 10GE SFP optical transceivers, depending on the model. FortiDDoS does not support multi-speed GE/10GE transceivers. All SFP Ports are fail-closed only. Fail-open requires an external 3rd-party bypass bridge.

  • FDD-2000F has a separate front panel 2-link Optical Bypass module that is used with up to 2 pairs of SFP+/QSFP optical transceivers (Single Mode, LR only), to provide fail-open functionality.

See the Quick-Start Guide for further port information and traffic bypass (fail-open) information.

For more information, see Appendix G: SFP Compatibility Reference.

Management interface configurations and status page

The Management Ports status page displays the existing management interface configuration and status information. To change the displayed columns, click the (Gear icon).

To edit an existing management interface configuration, click the (Edit icon) or double-click the row.

Management Ports Settings

Setting

Description

Name The name of the management interface — Mgmt1 or mgmt2. This is not configurable.
IPv4/Netmask IP Address of the port with netmask.
IPv6/Prefix IP Address of the port with prefix.
Allow Access

Select either of the following to allow access and monitoring:

  • HTTPS

  • Ping

  • SSH

  • SNMP

  • HTTP

  • Telnet

Note:

HTTP is no longer supported. If enabled, HTTP access will be referred to HTTPS.

System > Admin > Settings has default ports for the above access settings which cannot be deleted. For example, you can use these settings to prevent Telnet access.

Link Status Displays port connection status. This is not configurable.

Config Status

Displays port config status — Enable or Disable.

Network interface status page

The Traffic Ports status page displays the port and link information for existing network interface configurations. To change the displayed columns, click the (Gear icon).

To edit an existing network interface configuration, click the (Edit icon) or double-click the row.

Traffic Ports Settings

Setting

Description

Name The system-defined port and port-pair names. This is not configurable.
Logical Name The user-configured name for Ports or Port Pairs. Maximum 35 characters with following special characters allowed: ! * _ + - , . /
Direction Displays the port direction (WAN-facing or LAN-facing). This is not configurable. Reminder that odd-numbered ports face the inside network and even-numbered ports face the Internet/ISP.

Link Down Sync

Displays the Link Down Sync configured for each port-pair.
Duplex The duplex setting as negotiated automatically by transceivers. This is not configurable.
Link Speed The speed setting as negotiated automatically by transceivers. This is not configurable.
Link Status The link status as determined by transceivers.
Config Status The link status as configured by the administrator.

(Gear icon)

Click to change displayed columns.

(Edit icon)

Click to edit Port Pair and Port settings.

Add Filter

The Traffic Ports list can be filtered by Name, Logical Name, Direction (WAN-facing or LAN-facing), Link Down Sync, Duplex, Link Speed, Link Status and Config Status.

Interface Pair Settings

Setting

Description

Status Enable/Disable this port-pair.
Link Down Sync
  • Wire (recommended) — If a port loses signal (electrical/optical) from the connected device, it will reflect this loss-of-signal to its paired port, propagating the signal loss through the network so that routers and firewalls see the outage and re-route. Higher layer protocols may detect outages as well.

  • Hub — Loss of signal is not propagated to the other paired port.

Add Filter The Interface Pair list can be filtered by Name, Logical Name, Direction (WAN-facing or LAN-facing), Config Status or Link Status.

Settings such as speed, duplex, etc., cannot be changed for mgmt1 and mgmt2. The only settings allowed to be changed are:

  • Protocol access to the interface the interface Note, HTTP, if allowed will always be referred to HTTPS

  • IP address of interface
  • IP6 IPv6 address of interface
  • Logical Name
  • static or dhcp mode
  • maximum transportation unit — MTU

CLI commands for management ports

Modifying settings:

    config system interface
	edit {mgmt1|mgmt2}
		set ip <address_ipv4> <netmask_ipv4mask>
		set ipv6 <address_ipv6> <netmask_ipv6mask>
		set logicalname {string – 16 characters a-Z, 0-9, “-“, “_”}
		set allowaccess {https ping ssh snmp http telnet sql}
		set mode {static|dhcp}
		set mtu
	end
 
Confirming settings:

	config system interface
	   edit {mgmt1|mgmt2}
  	   show
	end

CLI commands for data ports

Modifying settings:

   	config system interface
   	   edit {portX} (X=1-16 depending on model)
		set logicalname {string – 16 characters a-Z, 0-9, “-“, “_”}
		set status {up|down}
   	end
 
Confirming settings:

	config system interface
	   edit {portX} (X=1-16 depending on model)
	   show
	end

CLI commands for network traffic port troubleshooting

   	get transceiver status
   	get transceiver status {portX} (X= 1-16, depending on model)

Optical Transceivers (of all types) vary widely in what readable measurements they support. Fortinet tries to acquire SFPs that support all of the below but cannot guarantee all are supported. You may see 0.0 “N/A” or “??” in fields that are not supported.

Note: Most Short Range and GE or 10EG transceivers do not support reporting of any electrical or optical properties.

Output for get transceiver status (if supported by SFP)

Interface

Temperature (Celsius)

Voltage (v)

Optica Tx Bias

(mA)

Optical Tx Power (dBm)

Optical Rx Power (dBm)

Each cell will have a numerical entry if supported plus characters to indicate quality of the parameter:

++ = high alarm | + = high warning | - = low warning | -- = low alarm | ? = not supported.

Any warning or alarm should be investigated further with the specific port status command.

Example:

port1

31.8

3.32

7.25

-2.3

-3.6

Output for get transceiver status portX (if supported by SFP)

Most vendors will support the following:

  • Vendor Name: Example - FINSIAR
  • Part No.: Example - FTL410QE2C
  • Serial No.: Example - MPM00P9

Support for the following is variable across vendors and types of SFPs.

Note: SR/Multi-Mode transceivers seldom provide any of this information since they are “low stress” parts. 10GE LR transceivers may not provide this information either.

Long Range, higher bandwidth transceivers will usually provide more info.

Output will be formatted as follows:

Measurement Unit

Value

High Alarm

High Warning

Low Warning

Low Alarm

Temperature

Celsius

Look for temperature above High Warning/Alarm

Voltage

Volts

Look for voltage above or below High or Low Warning/Alarm. Nominal voltage is 3.5v

CH1 Tx Bias

CH2 Tx Bias

CH3 Tx Bias

CH4 Tx Bias

mA

Bias is used to indicate aging and infer Tx power and laser aging.

Higher Bias is used to increase output power as the laser performance fades with age. Look for Bias that triggers High Warning/Alarm.

Note Transceivers use different numbers of channels. GE/10GE/25GE will show a single channel. 40GE/100GE will show 4 channels. Any channel with Warning/Alarm bias level is at best beginning to fail and should be replaced. Use of high bias can increase bit error rates.

CH1 Tx Power

CH2 Tx Power

CH3 Tx Power

CH4 Tx Power

dBm

Very few transceivers will provide explicit Tx power levels.

High or low Tx Power can affect bit error rate. High Tx Power may require attenuation on very short connections. Low Tx power may require replacement of the transceiver.

CH1 Rx Power

CH2 Rx Power

CH3 Rx Power

CH4 Rx Power

dBm

Look for Rx above High Warning/Alarm or below Low Warning Alarm.

Note Transceivers use different numbers of channels. GE/10GE/25GE will show a single channel. 40GE/100GE will show 4 channels.

Even one channel out-of-tolerance will affect bit error rate and reach especially with 40GE/100GE transceivers.

If Rx Power is too high, attenuation many be required at the interface. If Rx Power is too low, longer reach transceivers are required at both ends of the link.

Configuring network interfaces

The network interfaces that are bound to physical ports have three uses:

  • Management—Ports mgmt1 and mgmt2 are management interfaces. Management interfaces are used for administrator connections and to send management traffic, like syslog and SNMP traffic. Typically, administrators use mgmt1 for the management interface, but either or both can be used.
    • HA—If you plan to deploy HA, you must select a physical management port for HA heartbeat and synchronization traffic. Typically, administrators use mgmt2 for the HA interface for direct-connection between appliances, but either can be used, even if in use for administrative access, if both devices have Layer 2 connectivity (not direct-cabled). Please see System > High Availability for settings and HA system requirements .
  • Traffic—The remaining physical port-pairs ports can be used for data traffic — these are "Traffic Ports". The FortiDDoS system is deployed inline (between the Internet and your local network resources). Consecutive odd-even ports belong to port pairs: Use odd port numbers (1, 3, 5, and so on) for the LAN-side connection and even port numbers (2, 4, 6, and so on) for the WAN-side connection. For example, port1 and port2 are a pair. The port1 interface is connected to a switch that connects servers in the local network; the port2 interface is connected to the network path that receives traffic from the Internet.

Note:

  • 1000Base-T/GE copper ports use auto-negotiation to determine the connection speed. No other options are available. All 1000Base-T port-pairs support optional (default) fail-open.

  • LC ports house GE or 10GE optical transceivers, depending on the model. No other speed options are available. All LC port-pairs support optional (default) fail-open.

  • SFP ports support GE SFP (optical or copper) or 10GE SFP optical transceivers, depending on the model. FortiDDoS does not support multi-speed GE/10GE transceivers. All SFP Ports are fail-closed only. Fail-open requires an external 3rd-party bypass bridge.

  • FDD-2000F has a separate front panel 2-link Optical Bypass module that is used with up to 2 pairs of SFP+/QSFP optical transceivers (Single Mode, LR only), to provide fail-open functionality.

See the Quick-Start Guide for further port information and traffic bypass (fail-open) information.

For more information, see Appendix G: SFP Compatibility Reference.

Management interface configurations and status page

The Management Ports status page displays the existing management interface configuration and status information. To change the displayed columns, click the (Gear icon).

To edit an existing management interface configuration, click the (Edit icon) or double-click the row.

Management Ports Settings

Setting

Description

Name The name of the management interface — Mgmt1 or mgmt2. This is not configurable.
IPv4/Netmask IP Address of the port with netmask.
IPv6/Prefix IP Address of the port with prefix.
Allow Access

Select either of the following to allow access and monitoring:

  • HTTPS

  • Ping

  • SSH

  • SNMP

  • HTTP

  • Telnet

Note:

HTTP is no longer supported. If enabled, HTTP access will be referred to HTTPS.

System > Admin > Settings has default ports for the above access settings which cannot be deleted. For example, you can use these settings to prevent Telnet access.

Link Status Displays port connection status. This is not configurable.

Config Status

Displays port config status — Enable or Disable.

Network interface status page

The Traffic Ports status page displays the port and link information for existing network interface configurations. To change the displayed columns, click the (Gear icon).

To edit an existing network interface configuration, click the (Edit icon) or double-click the row.

Traffic Ports Settings

Setting

Description

Name The system-defined port and port-pair names. This is not configurable.
Logical Name The user-configured name for Ports or Port Pairs. Maximum 35 characters with following special characters allowed: ! * _ + - , . /
Direction Displays the port direction (WAN-facing or LAN-facing). This is not configurable. Reminder that odd-numbered ports face the inside network and even-numbered ports face the Internet/ISP.

Link Down Sync

Displays the Link Down Sync configured for each port-pair.
Duplex The duplex setting as negotiated automatically by transceivers. This is not configurable.
Link Speed The speed setting as negotiated automatically by transceivers. This is not configurable.
Link Status The link status as determined by transceivers.
Config Status The link status as configured by the administrator.

(Gear icon)

Click to change displayed columns.

(Edit icon)

Click to edit Port Pair and Port settings.

Add Filter

The Traffic Ports list can be filtered by Name, Logical Name, Direction (WAN-facing or LAN-facing), Link Down Sync, Duplex, Link Speed, Link Status and Config Status.

Interface Pair Settings

Setting

Description

Status Enable/Disable this port-pair.
Link Down Sync
  • Wire (recommended) — If a port loses signal (electrical/optical) from the connected device, it will reflect this loss-of-signal to its paired port, propagating the signal loss through the network so that routers and firewalls see the outage and re-route. Higher layer protocols may detect outages as well.

  • Hub — Loss of signal is not propagated to the other paired port.

Add Filter The Interface Pair list can be filtered by Name, Logical Name, Direction (WAN-facing or LAN-facing), Config Status or Link Status.

Settings such as speed, duplex, etc., cannot be changed for mgmt1 and mgmt2. The only settings allowed to be changed are:

  • Protocol access to the interface the interface Note, HTTP, if allowed will always be referred to HTTPS

  • IP address of interface
  • IP6 IPv6 address of interface
  • Logical Name
  • static or dhcp mode
  • maximum transportation unit — MTU

CLI commands for management ports

Modifying settings:

    config system interface
	edit {mgmt1|mgmt2}
		set ip <address_ipv4> <netmask_ipv4mask>
		set ipv6 <address_ipv6> <netmask_ipv6mask>
		set logicalname {string – 16 characters a-Z, 0-9, “-“, “_”}
		set allowaccess {https ping ssh snmp http telnet sql}
		set mode {static|dhcp}
		set mtu
	end
 
Confirming settings:

	config system interface
	   edit {mgmt1|mgmt2}
  	   show
	end

CLI commands for data ports

Modifying settings:

   	config system interface
   	   edit {portX} (X=1-16 depending on model)
		set logicalname {string – 16 characters a-Z, 0-9, “-“, “_”}
		set status {up|down}
   	end
 
Confirming settings:

	config system interface
	   edit {portX} (X=1-16 depending on model)
	   show
	end

CLI commands for network traffic port troubleshooting

   	get transceiver status
   	get transceiver status {portX} (X= 1-16, depending on model)

Optical Transceivers (of all types) vary widely in what readable measurements they support. Fortinet tries to acquire SFPs that support all of the below but cannot guarantee all are supported. You may see 0.0 “N/A” or “??” in fields that are not supported.

Note: Most Short Range and GE or 10EG transceivers do not support reporting of any electrical or optical properties.

Output for get transceiver status (if supported by SFP)

Interface

Temperature (Celsius)

Voltage (v)

Optica Tx Bias

(mA)

Optical Tx Power (dBm)

Optical Rx Power (dBm)

Each cell will have a numerical entry if supported plus characters to indicate quality of the parameter:

++ = high alarm | + = high warning | - = low warning | -- = low alarm | ? = not supported.

Any warning or alarm should be investigated further with the specific port status command.

Example:

port1

31.8

3.32

7.25

-2.3

-3.6

Output for get transceiver status portX (if supported by SFP)

Most vendors will support the following:

  • Vendor Name: Example - FINSIAR
  • Part No.: Example - FTL410QE2C
  • Serial No.: Example - MPM00P9

Support for the following is variable across vendors and types of SFPs.

Note: SR/Multi-Mode transceivers seldom provide any of this information since they are “low stress” parts. 10GE LR transceivers may not provide this information either.

Long Range, higher bandwidth transceivers will usually provide more info.

Output will be formatted as follows:

Measurement Unit

Value

High Alarm

High Warning

Low Warning

Low Alarm

Temperature

Celsius

Look for temperature above High Warning/Alarm

Voltage

Volts

Look for voltage above or below High or Low Warning/Alarm. Nominal voltage is 3.5v

CH1 Tx Bias

CH2 Tx Bias

CH3 Tx Bias

CH4 Tx Bias

mA

Bias is used to indicate aging and infer Tx power and laser aging.

Higher Bias is used to increase output power as the laser performance fades with age. Look for Bias that triggers High Warning/Alarm.

Note Transceivers use different numbers of channels. GE/10GE/25GE will show a single channel. 40GE/100GE will show 4 channels. Any channel with Warning/Alarm bias level is at best beginning to fail and should be replaced. Use of high bias can increase bit error rates.

CH1 Tx Power

CH2 Tx Power

CH3 Tx Power

CH4 Tx Power

dBm

Very few transceivers will provide explicit Tx power levels.

High or low Tx Power can affect bit error rate. High Tx Power may require attenuation on very short connections. Low Tx power may require replacement of the transceiver.

CH1 Rx Power

CH2 Rx Power

CH3 Rx Power

CH4 Rx Power

dBm

Look for Rx above High Warning/Alarm or below Low Warning Alarm.

Note Transceivers use different numbers of channels. GE/10GE/25GE will show a single channel. 40GE/100GE will show 4 channels.

Even one channel out-of-tolerance will affect bit error rate and reach especially with 40GE/100GE transceivers.

If Rx Power is too high, attenuation many be required at the interface. If Rx Power is too low, longer reach transceivers are required at both ends of the link.