Fortinet black logo

Handbook

Interface settings

6.0.0
Copy Link
Copy Doc ID 4afb0436-a998-11e9-81a4-00505692583a:62349
Download PDF

Interface settings

You configure FortiGate interfaces, both physical and virtual, in Network > Interfaces in the FortiGate GUI. There are different options for configuring interfaces when FortiGate is in NAT mode or transparent mode.

On FortiOS Carrier, you can also enable the Gi gatekeeper on each interface for anti-overbilling.

Field

Description

Create New

Select this to add a new interface, zone, or virtual wire pair.

Depending on the FortiGate model, you can add a VLAN interface, a loopback interface, an IEEE 802.3ad aggregated interface, or a redundant interface.

When VDOMs are enabled, you can also add Inter-VDOM links.

Interface Name

The names of the physical interfaces on FortiGate. This includes any alias names that have been configured.

When you combine several interfaces into an aggregate or redundant interface, only the aggregate or redundant interface is listed, and not the component interfaces.

If you added VLAN interfaces, they appear in the name list below the physical or aggregated interface to which they have been added.

If you added loopback interfaces, they appear in the interface list below the physical interface to which they have been added. If software switch interfaces are configured, you can view them.

If your FortiGate model supports AMC modules, the interfaces are named amc-sw1/1, amc-dw1/2, and so on.

Type

The configuration type for the interface.

IP/Network Mask

The current IP address and netmask of the interface.

In VDOM, when VDOMs are not all in NAT or transparent mode, some values may not be available for display and are displayed as “-”.

Administrative Access

The administrative access configuration for the interface.

Administrative Status

Indicates if the interface can be accessed for administrative purposes. If the administrative status is a green arrow, an administrator can connect to the interface using the configured access.

If the administrative status is a red arrow, the interface is administratively down and can't be accessed for administrative purposes.

Link Status

The status of the interface physical connection. The link status can be up (green arrow) or down (red arrow). If the link status is up, the interface is connected to the network and accepting traffic. If the link status is down, the interface is either not connected to the network or there is a problem with the connection.

You can't change the link status from the FortiGate GUI, and it typically indicates that an Ethernet cable is plugged into the interface.

The link status is only displayed for physical interfaces.

MAC

The MAC address of the interface.

Addressing mode

The addressing mode of the interface. This value can be manual, DHCP, or PPPoE.

Secondary IP Address

The secondary IP addresses added to the interface.

MTU

The maximum number of bytes per transmission unit for the interface.

Virtual Domain

The virtual domain to which the interface belongs. This column is visible when VDOM configuration is enabled.

VLAN ID

The configured VLAN ID for VLAN subinterfaces.

Interface configuration and settings

To configure an interface, go to Network > Interfaces, and select Create New and then Interface.

Interface Name

Enter the name of the interface. Physical interface names can't be changed.

Alias

Enter an alternate name for a physical interface on the FortiGate unit. This field appears when you edit an existing physical interface.

The alias is a maximum of 25 characters. The alias name doesn't appear in logs.

Link Status

Indicates whether the interface is connected to a network (link status is Up) or not (link status is Down). This field appears when you edit an existing physical interface.

Type

Select the type of interface you want to add.

On some FortiGate models, you can set Type to 802.3ad Aggregate or Redundant Interface.

Interface

This is displayed when Type is set to VLAN.

Select the name of the physical interface that you want to add a VLAN interface to. Once created, the VLAN interface is listed below its physical interface in the Interface list.

You can't change the physical interface of a VLAN interface except when you add a new VLAN interface.

VLAN ID

This is displayed when Type is set to VLAN.

Enter the VLAN ID. You can't change the VLAN ID except when you add a new VLAN interface.

The VLAN ID must be a number between 1 and 4094. It must match the VLAN ID that the IEEE 802.1Q-compliant router or switch that is connected to the VLAN subinterface adds.

Virtual Domain

Select the virtual domain to add the interface to.

Administrator accounts with the super_admin profile can change the Virtual Domain.

Interface Members

This section can have two different formats depending on the interface type:

  • Software Switch: This section is a display-only field that shows the interfaces that belong to the virtual interface of the software switch.
  • 802.3ad Aggregate or Redundant Interface: This section includes the available interface list and the selected interface list.

In the Interface Members field, select +, and select interfaces from the Select Entries window. Select Close.

Addressing mode

Select the addressing mode for the interface:

  • Select Manual and add an IP/Netmask for the interface. If IPv6 configuration is enabled, you can add both a IPv4 and an IPv6 IP address.
  • Select DHCP to get the interface IP address and other network settings from a DHCP server.
  • Select PPPoE to get the interface IP address and other network settings from a PPPoE server.
  • Select One-Arm Sniffer to enable the interface as a means to detect possible traffic threats. This option is available on physical ports that aren't configured for the primary Internet connection.
  • Select Dedicate to FortiAP/FortiSwitch to have a FortiAP or FortiSwitch device connect exclusively to the interface. This option is available only when you edit a physical interface and it has a static IP address. When you enter the IP address, FortiGate automatically creates a DHCP server using the subnet that you enter. This option is not available on the ADSL interface.

The FortiSwitch option is currently available only on the FortiGate 100D.

IP/Netmask

If Addressing Mode is set to Manual, enter an IPv4 address and subnet mask for the interface. FortiGate interfaces can't have IP addresses on the same subnet.

IPv6 Address

If Addressing Mode is set to Manual and IPv6 support is enabled, enter an IPv6 address and subnet mask for the interface. A single interface can have an IPv4 address, IPv6 address, or both.

Administrative Access

Select the types of administrative access that you want to allow for IPv4 connections to this interface.

HTTPS

Allow secure HTTPS connections to the FortiGate GUI through this interface. If configured, this option will enable automatically when you select the HTTP option.

PING

The interface responds to pings. Use this setting to verify your installation and for testing.

HTTP

Allow HTTP connections to the FortiGate GUI through this interface. If configured, this option will also enable the HTTPS option.

SSH

Allow SSH connections to the CLI through this interface.

SNMP

Allow a remote SNMP manager to request SNMP information by connecting to this interface.

FMG-Access

Allow FortiManager authorization automatically during the communication exchanges between FortiManager and FortiGate devices.

CAPWAP

Allows the FortiGate wireless controller to manage a wireless access point, such as a FortiAP device.

IPv6 Administrative Access

Select the types of administrative access that you want to allow for IPv6 connections to this interface. The types are the same as for Administrative Access.

Security Mode

Select a captive portal for the interface. After you select this, you can define the portal message and the appearance of the GUI that users see when they log into the interface. You can also define one or more user groups that can access the interface.

DHCP Server

Select this to enable a DHCP server for the interface. For more information about configuring a DHCP server on the interface, see DHCP servers and relays.

Device Detection

Select this to allow the interface to be used with BYOD devices, such as iPhones. Define the device definitions by selecting User & Device > Device Inventory in the FortiGate GUI.

Enable Explicit Web Proxy

Select this to enable explicit web proxying on this interface.

This is available when you enable explicit proxy in the System Information Dashboard (System > Dashboard > Status).

When you enable this, the interface will be displayed in System > Network > Explicit Proxy, under Listen on Interfaces, and web traffic on this interface will be proxied according to the Web Proxy settings.

This option isn't available for a VLAN interface selection.

Secondary IP Address

Add additional IPv4 addresses to this interface. Select the expand arrow to expand or hide the section.

Comments

Enter a description (up to 63 characters) to describe the interface.

Gi Gatekeeper (FortiOS Carrier only)

For FortiOS Carrier, enable this to enable the Gi firewall as part of the anti-overbilling configuration. You must also configure Gi Gatekeeper Settings by selecting System > Admin > Settings in the FortiGate GUI.

If you assign an interface to be part of a virtual wire pairing, the value in the Role field is removed from the interface.

Interface settings

You configure FortiGate interfaces, both physical and virtual, in Network > Interfaces in the FortiGate GUI. There are different options for configuring interfaces when FortiGate is in NAT mode or transparent mode.

On FortiOS Carrier, you can also enable the Gi gatekeeper on each interface for anti-overbilling.

Field

Description

Create New

Select this to add a new interface, zone, or virtual wire pair.

Depending on the FortiGate model, you can add a VLAN interface, a loopback interface, an IEEE 802.3ad aggregated interface, or a redundant interface.

When VDOMs are enabled, you can also add Inter-VDOM links.

Interface Name

The names of the physical interfaces on FortiGate. This includes any alias names that have been configured.

When you combine several interfaces into an aggregate or redundant interface, only the aggregate or redundant interface is listed, and not the component interfaces.

If you added VLAN interfaces, they appear in the name list below the physical or aggregated interface to which they have been added.

If you added loopback interfaces, they appear in the interface list below the physical interface to which they have been added. If software switch interfaces are configured, you can view them.

If your FortiGate model supports AMC modules, the interfaces are named amc-sw1/1, amc-dw1/2, and so on.

Type

The configuration type for the interface.

IP/Network Mask

The current IP address and netmask of the interface.

In VDOM, when VDOMs are not all in NAT or transparent mode, some values may not be available for display and are displayed as “-”.

Administrative Access

The administrative access configuration for the interface.

Administrative Status

Indicates if the interface can be accessed for administrative purposes. If the administrative status is a green arrow, an administrator can connect to the interface using the configured access.

If the administrative status is a red arrow, the interface is administratively down and can't be accessed for administrative purposes.

Link Status

The status of the interface physical connection. The link status can be up (green arrow) or down (red arrow). If the link status is up, the interface is connected to the network and accepting traffic. If the link status is down, the interface is either not connected to the network or there is a problem with the connection.

You can't change the link status from the FortiGate GUI, and it typically indicates that an Ethernet cable is plugged into the interface.

The link status is only displayed for physical interfaces.

MAC

The MAC address of the interface.

Addressing mode

The addressing mode of the interface. This value can be manual, DHCP, or PPPoE.

Secondary IP Address

The secondary IP addresses added to the interface.

MTU

The maximum number of bytes per transmission unit for the interface.

Virtual Domain

The virtual domain to which the interface belongs. This column is visible when VDOM configuration is enabled.

VLAN ID

The configured VLAN ID for VLAN subinterfaces.

Interface configuration and settings

To configure an interface, go to Network > Interfaces, and select Create New and then Interface.

Interface Name

Enter the name of the interface. Physical interface names can't be changed.

Alias

Enter an alternate name for a physical interface on the FortiGate unit. This field appears when you edit an existing physical interface.

The alias is a maximum of 25 characters. The alias name doesn't appear in logs.

Link Status

Indicates whether the interface is connected to a network (link status is Up) or not (link status is Down). This field appears when you edit an existing physical interface.

Type

Select the type of interface you want to add.

On some FortiGate models, you can set Type to 802.3ad Aggregate or Redundant Interface.

Interface

This is displayed when Type is set to VLAN.

Select the name of the physical interface that you want to add a VLAN interface to. Once created, the VLAN interface is listed below its physical interface in the Interface list.

You can't change the physical interface of a VLAN interface except when you add a new VLAN interface.

VLAN ID

This is displayed when Type is set to VLAN.

Enter the VLAN ID. You can't change the VLAN ID except when you add a new VLAN interface.

The VLAN ID must be a number between 1 and 4094. It must match the VLAN ID that the IEEE 802.1Q-compliant router or switch that is connected to the VLAN subinterface adds.

Virtual Domain

Select the virtual domain to add the interface to.

Administrator accounts with the super_admin profile can change the Virtual Domain.

Interface Members

This section can have two different formats depending on the interface type:

  • Software Switch: This section is a display-only field that shows the interfaces that belong to the virtual interface of the software switch.
  • 802.3ad Aggregate or Redundant Interface: This section includes the available interface list and the selected interface list.

In the Interface Members field, select +, and select interfaces from the Select Entries window. Select Close.

Addressing mode

Select the addressing mode for the interface:

  • Select Manual and add an IP/Netmask for the interface. If IPv6 configuration is enabled, you can add both a IPv4 and an IPv6 IP address.
  • Select DHCP to get the interface IP address and other network settings from a DHCP server.
  • Select PPPoE to get the interface IP address and other network settings from a PPPoE server.
  • Select One-Arm Sniffer to enable the interface as a means to detect possible traffic threats. This option is available on physical ports that aren't configured for the primary Internet connection.
  • Select Dedicate to FortiAP/FortiSwitch to have a FortiAP or FortiSwitch device connect exclusively to the interface. This option is available only when you edit a physical interface and it has a static IP address. When you enter the IP address, FortiGate automatically creates a DHCP server using the subnet that you enter. This option is not available on the ADSL interface.

The FortiSwitch option is currently available only on the FortiGate 100D.

IP/Netmask

If Addressing Mode is set to Manual, enter an IPv4 address and subnet mask for the interface. FortiGate interfaces can't have IP addresses on the same subnet.

IPv6 Address

If Addressing Mode is set to Manual and IPv6 support is enabled, enter an IPv6 address and subnet mask for the interface. A single interface can have an IPv4 address, IPv6 address, or both.

Administrative Access

Select the types of administrative access that you want to allow for IPv4 connections to this interface.

HTTPS

Allow secure HTTPS connections to the FortiGate GUI through this interface. If configured, this option will enable automatically when you select the HTTP option.

PING

The interface responds to pings. Use this setting to verify your installation and for testing.

HTTP

Allow HTTP connections to the FortiGate GUI through this interface. If configured, this option will also enable the HTTPS option.

SSH

Allow SSH connections to the CLI through this interface.

SNMP

Allow a remote SNMP manager to request SNMP information by connecting to this interface.

FMG-Access

Allow FortiManager authorization automatically during the communication exchanges between FortiManager and FortiGate devices.

CAPWAP

Allows the FortiGate wireless controller to manage a wireless access point, such as a FortiAP device.

IPv6 Administrative Access

Select the types of administrative access that you want to allow for IPv6 connections to this interface. The types are the same as for Administrative Access.

Security Mode

Select a captive portal for the interface. After you select this, you can define the portal message and the appearance of the GUI that users see when they log into the interface. You can also define one or more user groups that can access the interface.

DHCP Server

Select this to enable a DHCP server for the interface. For more information about configuring a DHCP server on the interface, see DHCP servers and relays.

Device Detection

Select this to allow the interface to be used with BYOD devices, such as iPhones. Define the device definitions by selecting User & Device > Device Inventory in the FortiGate GUI.

Enable Explicit Web Proxy

Select this to enable explicit web proxying on this interface.

This is available when you enable explicit proxy in the System Information Dashboard (System > Dashboard > Status).

When you enable this, the interface will be displayed in System > Network > Explicit Proxy, under Listen on Interfaces, and web traffic on this interface will be proxied according to the Web Proxy settings.

This option isn't available for a VLAN interface selection.

Secondary IP Address

Add additional IPv4 addresses to this interface. Select the expand arrow to expand or hide the section.

Comments

Enter a description (up to 63 characters) to describe the interface.

Gi Gatekeeper (FortiOS Carrier only)

For FortiOS Carrier, enable this to enable the Gi firewall as part of the anti-overbilling configuration. You must also configure Gi Gatekeeper Settings by selecting System > Admin > Settings in the FortiGate GUI.

If you assign an interface to be part of a virtual wire pairing, the value in the Role field is removed from the interface.