Virtual switch

The virtual switch feature allows you create virtual switches on top of physical switches with designated interfaces/ports so that a virtual switch can build up its forwarding table through learning and forward traffic accordingly. When traffic is forwarded among interfaces belonging to the same virtual switch, the traffic doesn't need to go up to the software stack, but is forwarded directly by the switch. When traffic has to be relayed to interfaces not on the virtual switch, the traffic will go through the normal data path and be offloaded to NP4, when possible.

This feature is only available on mid- to high-end FortiGate devices, including the 100D, 600C, 1000C, and 1240B.

To enable and configure the virtual switch – CLI

config system virtual-switch

edit vs1

set physical-switch sw0

config port

edit 1

set port port1

set speed xx

set duplex xx

set status [up|down]

edit 2

set port port2

set ...

next

next

end

Support for 802.1x fallback and 802.1x dynamic VLANs

There are four modes when enabling 802.1x on a virtual switch interface:

Mode	Description
Default	In this mode, it works as it did previously.
Fallback	In fallback mode, the virtual switch is treated as a primary. Only one secondary can refer to a fallback primary. The ports in the primary virtual switch are always authorized. After passing 802.1x authentication, the ports will stay authorized and move to its secondary virtual switch.
Dynamic-vlan	In dynamic-vlan mode, the virtual switch is also treated as a primary. However, many secondary devices can refer to a dynamic-vlan primary. Those ports in the primary virtual switch are always unauthorized. After passing 802.1x/MAB authentication, the ports are set to authorized and moved to one of its secondary virtual switches.
Slave	In secondary mode, a primary must be set through security-8021x-master attribute. A secondary virtual switch will use its primary virtual switch's security-groups settings for authentication.

CLI example for fallback mode:

config system virtual-switch

edit "fallsw"

set physical-switch "sw0"

config port

next

edit "trust"

set physical-switch "sw0"

next

config system interface

edit "fallsw"

set vdom "root"

set ip 192.168.20.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet fgfm auto-ipsec radius-acct proberesponse capwap

set type hard-switch

set security-mode 802.1X

set security-8021x-mode fallback(fallback mode master switch)

set security-groups "rds-grp"(the usergroup for 802.1x)

set snmp-index 10

next

edit "trust"

set vdom "root"

set ip 192.168.22.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet fgfm auto-ipsec radius-acct proberesponse

set type hard-switch

set security-mode 802.1X

set security-8021x-mode slave(slave mode switch)

set security-8021x-master "fallsw" (its master switch)

set snmp-index 6

next

end

CLI example for dynamic-vlan mode:

config system virtual-switch

edit "internal"

set physical-switch "sw0"

edit "lan-trust"

set physical-switch "sw0"

next

edit "lan-vlan1000"

set physical-switch "sw0"

next

edit "lan-vlan2000"

set physical-switch "sw0"

config port

edit "internal1" (normally we should not add port in slave switch. This is used if

user wants to manually add one port in slave)

next

end

config system interface

edit "internal"

set vdom "root"

set ip 192.168.11.99 255.255.255.0

set allowaccess ping https ssh http fgfm capwap

set type hard-switch

set security-mode 802.1X

set security-8021x-mode dynamic-vlan<------dynamic-vlan mode master switch

set security-groups "rds-grp"<------the usergroup for 802.1x

set snmp-index 15

next

edit "lan-trust"

set vdom "root"

set ip 192.168.111.99 255.255.255.0

set allowaccess ping https ssh snmp http telnet fgfm auto-ipsec radius-acct proberesponse capwap

set type hard-switch

set security-mode 802.1X

set security-8021x-mode slave<-----slave mode switch

set security-8021x-master "internal"<-----its master switch

set snmp-index 7

next

edit "lan-vlan1000"

set vdom "root"

set ip 192.168.110.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet fgfm auto-ipsec radius-acct proberesponse capwap

set type hard-switch

set security-mode 802.1X

set security-8021x-mode slave<-----slave mode switch

set security-8021x-master "internal"<-----its master switch

set security-8021x-dynamic-vlan-id 1000 <-----the matching vlan id for this virtual

switch

set snmp-index 16

next

edit "lan-vlan2000"

set vdom "root"

set ip 192.168.220.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet fgfm auto-ipsec radius-acct proberesponse

capwap

set type hard-switch

set security-mode 802.1X

set security-8021x-mode slave

set security-8021x-master "internal"

set security-8021x-dynamic-vlan-id 2000

set snmp-index 17

end

config user group

edit "rds-grp"

set dynamic-vlan-id 4000(default vlan id if there is no vlan attribute return from server)

set member "190"

end