Hardware switch

A hardware switch is a virtual switch interface that groups different ports together so that the FortiGate can use the group as a single interface. Supported FortiGate models have a default hardware switch called either internal or lan. The hardware switch is supported by the chipset at the hardware level.

Ports that are connected to the same hardware switch behave like they are on the same physical switch in the same broadcast domain. Ports can be removed from a hardware switch and assigned to another switch or used as standalone interfaces.

Some of the difference between hardware and software switches are:

Feature	Hardware switch	Software switch
Processing	Packets are processed in hardware by the hardware switch controller, or SPU where applicable.	Packets are processed in software by the CPU.
STP	Supported	Not Supported
Wireless SSIDs	Not Supported	Supported
Intra-switch traffic	Allowed by default.	Allowed by default. Can be explicitly set to require a policy.

To change the ports in a hardware switch in the GUI:

1. Go to Network > Interface and edit the hardware switch.
2. Click inside the Interface members field.

   

3. Select interfaces to add or remove them from the hardware switch, then click Close.

   To add an interface to a hardware switch, it cannot be referenced by an existing configuration and its IP address must be set to 0.0.0.0/0.0.0.0.

4. Click OK.

   Removed interfaces will now be listed as standalone interfaces in the Physical Interface section.

To remove ports from a hardware switch in the CLI:

config system virtual-switch
    edit "internal"
        config port
            delete internal2
            delete internal7
            ...
        end
    next
end

To add ports to a hardware switch in the CLI:

config system virtual-switch
    edit "internal"
        set physical-switch "sw0"
        config port
            edit "internal3"
            next
            edit "internal5"
            next
            edit "internal4"
            next
            edit "internal6"
            next
        end
    next
end

To add an interface to a hardware switch, it cannot be referenced by an existing configuration and its IP address must be set to 0.0.0.0/0.0.0.0.

Using 802.1X on virtual switches for certain NP6 platforms

802.1X is supported under the hardware switch interface on the following NP6 platforms: FG-30xE, FG-40xE, and FG-110xE.

In this example, port3 and port4 are part of a hardware switch interface. The hardware switch acts as a virtual switch so that devices can connect directly to these ports and perform 802.1X authentication on the port.

Prerequisites:

1. Configure a RADIUS server (see RADIUS servers).
2. Define a user group named test to use the remote RADIUS server and for 802.1X authentication (see User definition and groups).
3. Configure a hardware switch (named 18188) with port3 and port4 as the members.
4. Configure a firewall policy that allows traffic from the 18188 hardware switch to go to the internet.
5. Enable 802.1X authentication on the client devices.

To configure 802.1X authentication on a hardware switch in the GUI:

1. Go to Network > Interfaces and edit the hardware switch.
2. In the Network section, enable Security mode and select 802.1X.
3. Click the + to add the User group.

   

4. Click OK.

To configure 802.1X authentication on a hardware switch in the CLI:

1. Configure the virtual hardware switch interfaces:

   config system virtual-switch
       edit "18188"
           set physical-switch "sw0"
           config port
               edit "port3"
               next
               edit "port4"
               next
           end
       next
   end

2. Configure 802.1X authentication:

   config system interface
       edit "18188"
           set vdom "vdom1"
           set ip 1.1.1.1 255.255.255.0
           set allowaccess ping https ssh snmp fgfm ftm
           set type hard-switch
           set security-mode 802.1X
           set security-groups "test"
           set device-identification enable
           set lldp-transmission enable
           set role lan
           set snmp-index 52
       next
   end

To verify the that the 802.1X authentication was successful:

1. Get a client connected to port3 to authenticate to access the internet.
2. In FortiOS, verify the 802.1X authentication port status:

   # diagnose sys 802-1x status
   
   Virtual switch '18188' (default mode) 802.1x member status:
     port3: Link up, 802.1X state: authorized
     port4: Link up, 802.1X state: unauthorized