Editing the port security

You can add port security with 802.1x port-based or MAC-based authentication.

To change the port security:

Select a FortiSwitch unit and click View Interface.
Select the interface and click Edit Port Security.
Select 802.1X for port-based authentication or select 802.1X MAC-Based for MAC-based authentication.
Select MAC Auth Bypass to allow the system to use the device MAC address as the user name and password for authentication.
If the RADIUS authentication server does not support EAP-TLS, clear the EAP Pass-Through Mode checkbox.
For phone and PC configuration only, clear the Frame VLAN Apply checkbox to preserve the native VLAN when the data traffic is expected to be untagged.
Select Open Authentication to enable open authentication (monitor mode) on this interface. Use the monitor mode to test your system configuration for 802.1x authentication. You can use monitor mode to test port-based authentication, MAC-based authentication, EAP pass-through mode, and MAC authentication bypass. After you enable monitor mode, the network traffic will continue to flow, even if the users fail authentication.
Select Guest VLAN if you want to assign a VLAN to unauthorized users. If you select Guest VLAN, enter the guest VLAN identifier in the Guest VLAN ID field and enter the number of seconds for an unauthorized user to have access as a guest before authorization fails in the Guest Auth Delay field.
Select Auth Fail VLAN if you want to assign a VLAN to users who attempted to authenticate but failed to provide valid credentials. If you select Auth Fail VLAN, enter the VLAN identifier in the Auth Fail VLAN ID field.
If you want to use the RADIUS-provided reauthentication time, select RADUS Session Timeout.
Click in the Security Groups field to select a security group. You can select multiple security groups.
Select Ok to apply your changes.

Editing the port security

You can add port security with 802.1x port-based or MAC-based authentication.

To change the port security:

Select a FortiSwitch unit and click View Interface.
Select the interface and click Edit Port Security.
Select 802.1X for port-based authentication or select 802.1X MAC-Based for MAC-based authentication.
Select MAC Auth Bypass to allow the system to use the device MAC address as the user name and password for authentication.
If the RADIUS authentication server does not support EAP-TLS, clear the EAP Pass-Through Mode checkbox.
For phone and PC configuration only, clear the Frame VLAN Apply checkbox to preserve the native VLAN when the data traffic is expected to be untagged.
Select Open Authentication to enable open authentication (monitor mode) on this interface. Use the monitor mode to test your system configuration for 802.1x authentication. You can use monitor mode to test port-based authentication, MAC-based authentication, EAP pass-through mode, and MAC authentication bypass. After you enable monitor mode, the network traffic will continue to flow, even if the users fail authentication.
Select Guest VLAN if you want to assign a VLAN to unauthorized users. If you select Guest VLAN, enter the guest VLAN identifier in the Guest VLAN ID field and enter the number of seconds for an unauthorized user to have access as a guest before authorization fails in the Guest Auth Delay field.
Select Auth Fail VLAN if you want to assign a VLAN to users who attempted to authenticate but failed to provide valid credentials. If you select Auth Fail VLAN, enter the VLAN identifier in the Auth Fail VLAN ID field.
If you want to use the RADIUS-provided reauthentication time, select RADUS Session Timeout.
Click in the Security Groups field to select a security group. You can select multiple security groups.
Select Ok to apply your changes.