<profile-name>

Enter the name for the profile.

admingrp {none | read | read-write}

Set the access permission for admingrp.

loggrp {none | read | read-write}

Set the access permission for loggrp.

netgrp {none | read | read-write}

Set the access permission for netgrp.

routegrp {none | read | read-write}

Set the access permission for routegrp.

<admin_name>

Enter the name for the admin account.

accprofile <profile‑name>

Enter the name of the access profile to assign to this administrator account. Access profiles control administrator access to FortiSwitch features.

accprofile-override {enable | disable}

Enable or disable whether the remote authentication server can override the accesss profile.

allow-remove-admin-session {enable | disable}

Allow admin session to be removed by privileged admin users

comments

<comments_string>

Enter the last name, first name, email address, phone number, mobile phone number, and pager number for this administrator. Separate each attribute with a comma, and enclose the string in double-quotes. The total length of the string can be up to 128 characters. (Optional)

gui-detail-panel-location {bottom | hide | side}

Choose the position of the log detail window.

{ip6-trusthost1 | ip6‑trusthost2 | ip6‑trusthost3 | ip6‑trusthost4 | ip6‑trusthost5 | ip6‑trusthost6 | ip6‑trusthost7 | ip6‑trusthost8 | ip6‑trusthost9 | ip6‑trusthost10}

<address_ipv6mask>

Any IPv6 address and netmask from which the administrator can connect to the FortiSwitch unit.

If you want the administrator to be able to access the system from any address, set the trusted hosts to ::/0.

password

<admin_password>

Enter the password for this administrator. It can be up to 256 characters in length.

peer-auth {disable | enable}

Set to enable peer certificate authentication (for HTTPS admin access).

peer-group <peer-grp>

Name of peer group defined under config user peergrp or user group defined under config user group. Used for peer certificate authentication (for HTTPS admin access). This option is available only when peer-auth has been enabled.

remote-auth

{enable | disable}

Enable or disable authentication of this administrator using a remote RADIUS, LDAP, or TACACS+ server.

remote-group <name>

Enter the administrator user group name, if you are using RADIUS, LDAP, or TACACS+ authentication.

This is available only when remote-auth is enabled.

wildcard {enable | disable}

Enable or disable wildcard RADIUS authentication. This option is available only when remote-auth is enabled.

schedule <schedule-name>

Restrict times that an administrator can log in. Defined in config firewall schedule. No default indicates that the administrator can log in at any time.

ssh-public-key1 "<key‑type> <key‑value>"

You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.

<key type> is ssh-dss for a DSA key or ssh-rsa for an RSA key.

<key-value> is the public key string of the SSH client.

ssh-public-key2 "<key‑type> <key‑value>"

ssh-public-key3 "<key‑type> <key‑value>"

{trusthost1 | trusthost2 |

trusthost3 | trusthost4 |

trusthost5 | trusthost6 |

trusthost7 | trusthost8 |

trusthost9 | trusthost10}

<address_ipv4mask>

Any IPv4 address or subnet address and netmask from which the administrator can connect to the system.

If you want the administrator to be able to access the system from any address, set the trusted hosts to 0.0.0.0 and the netmask to 0.0.0.0.

<table_value>

Enter the identification number for the table.

interface {<string> | internal | mgmt}

Enter the interface to associate with this ARP entry

ip <address_ipv4>

Enter the IP address of the ARP entry.

auth {no | yes}

Enter yes if the SMTP server requires authentication or no if it does not.

mailto <email_address>

The email address for bug reports.

password <password>

If the SMTP server requires authentication, enter the required password.

server <servername>

The SMTP server to use for sending bug report email.

username <name>

A valid user name on the specified SMTP server.

name

Enter the name of the certificate.

certificate

PEM format CA certificate. Paste the contents of a CA certificate file between quotation marks as shown in the example.

name

Name of the certificate revocation list

crl

PEM format CRL. Paste the contents of a CRL file between quotation marks.

http-url

URL of HTTP server for CRL update

ldap-server

LDAP server

scep-cert

Local certificate used for CRL update using SCEP

name

Enter the name of the certificate.

comments

Optional administrator note.

password

Password that was used to encrypt the file. The FortiCore system uses the password to decrypt and install the certificate.

private-key

Paste the contents of a key file between quotation marks as shown in the example.

cert {<string> | Entrust_802.1x_CA | Entrust_802.1x_G2_CA | Entrust_802.1x_L1K_CA | Fortinet_CA | Fortinet_CA2}

Enter the name of the certificate or select one of the listed certificates.

unavail-action {ignore | revoke}

Set if the FortiSwitch should ignore the OCSP check or revoke the certificate if the server is unavailable.

name

Name for the certificate

baudrate <speed>

Set the console port baudrate. Select one of 9600, 19200, 38400, 57600, or 115200.

mode {batch | line}

Set the console mode to line or batch. Used for autotesting only.

<id>

Enter the identifier.

auto-configuration {enable | disable}

Enable or disable automatic configuration. Auto configuration allows the DHCP server to dynamically assign IP addresses to hosts on the network connected to the interface

conflicted-ip-timeout <integer>

Enter the number of seconds before a conflicted IP address is removed from the DHCP range and is available to be reused. The range is 60-8640000 seconds.

default-gateway <xxx.xxx.xxx.xxx>

Enter the IP address of the default gateway that the DHCP server assigns to DHCP clients.

dns-server1 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the DNS server 1. This option is only available when dns-service is set to specify.

dns-server2 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the DNS server 2. This option is only available when dns-service is set to specify.

dns-server3 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the DNS server 3. This option is only available when dns-service is set to specify.

dns-service {default | local | specify}

Select how DNS servers are assigned to DHCP clients. Select local to use the IP address of the DHCP server interface for the clientʼs DNS server IP address. Select default for clients to be assigned the FortiSwitch unitʼs configured DNS servers. Select specify to enter the IPv4 address for up to three DNS servers.

domain <string>

Enter the domain name suffix for the IP addresses that the DHCP server assigns to the clients.

filename <string>

Enter the name of the boot file on the TFTP server.

interface <string>

Enter the name of the interface. The DHCP server can assign IP configurations to clients connected to this interface.

lease-time <integer>

The lease time determines the length of time an IP address remains assigned to a client. After the lease expires, the address is released for allocation to the next client that requests an IP address.

Enter the lease time in seconds. The range is 300-8640000. The default lease time is seven days.

netmask <xxx.xxx.xxx.xxx>

Enter the netmask of the addresses that the DHCP server assigns.

next-server <xxx.xxx.xxx.xxx>

Enter the IPv4 address of a server (for example, a TFTP sever) that DHCP clients can download a boot file from.

ntp-server1 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the NTP server 1. This option is only available when ntp-service is set to specify.

ntp-server2 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the NTP server 2. This option is only available when ntp-service is set to specify.

ntp-server3 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the NTP server 3. This option is only available when ntp-service is set to specify.

ntp-service {default | local | specify}

Select how Network Time Protocol (NTP) servers are assigned to DHCP clients. Select local to use the IP address of the DHCP server interface for the clientʼs NTP server IP address. Select default for clients to be assigned the FortiSwitch unitʼs configured NTP servers. Select specify to enter the IPv4 address for up to three NTP servers.

status {enable | disable}

Enable or disable this DHCP configuration.

tftp-server <string>

You can configure multiple Trivial File Transfer Protocol (TFTP) servers for a Dynamic Host Configuration Protocol (DHCP) server. For example, you may want to configure a main TFTP server and a backup TFTP server.

Enter the hostname or IP address of each TFTP server in quotes. Separate multiple server entries with spaces.

timezone <00-75>

Enter the time zone to be assigned to DHCP clients. This option is only available if timezone-option is set to specify.

timezone-option {default | disable | specify}

Select how the DHCP server sets the clientʼs time zone. Select disable for the DHCP server to not set the clientʼs time zone. Select default for clients to be assigned the FortiSwitch unitʼs configured time zone. Select specify to enter the time zone to be assigned to DHCP clients.

vci-match {enable | disable}

Enable or disable vendor class identifier (VCI) matching. When enabled, only DHCP requests with a matching VCI are served.

vci-string <VCI_strings>

Enter one or more VCI strings. This option is only available if vci-match is set to enable.

wifi-ac1 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the WiFi Access Controller 1 (DHCP option 138, RFC 5417).

wifi-ac2 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the WiFi Access Controller 2 (DHCP option 138, RFC 5417).

wifi-ac3 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the WiFi Access Controller 3 (DHCP option 138, RFC 5417).

wins-server1 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the WINS server 1.

wins-server2 <xxx.xxx.xxx.xxx>

Enter the IPv4 address for the WINS server 2.

<id>

Enter the identifier.

end-ip <xxx.xxx.xxx.xxx>

Enter the end of the IP address range that will not be assigned to clients.

start-ip <xxx.xxx.xxx.xxx>

Enter the start of the IP address range that will not be assigned to clients.

<id>

Enter the identifier.

end-ip <xxx.xxx.xxx.xxx>

Enter the end of the DHCP IP address range.

start-ip <xxx.xxx.xxx.xxx>

Enter the start of the DHCP IP address range.

<id>

Enter the identifier.

code <integer>

Select the DHCP option code. The range is 0-255.

ip <IP_addresses>

If type is set to ip, enter the IP addresses.

type {fqdn | hex | ip | string}

Select the format of the DHCP option: fully qualified domain name, hexadecimal, IP address, or string.

value <string>

Enter the DHCP option value. This option is available when type is set to fqdn, hex, or string.

<id>

Enter the identifier.

action {assign | block | reserved}

Select how the DHCP server configures the client with the reserved MAC address. Select assign for the DHCP server to configure the client with this MAC address like any other client. Select block to prevent the DHCP server from assigning IP settings to the client with this MAC address. Select reserved for the DHCP server to assign the reserved IP address to the client with this MAC address.

circuit-id {<string> | <hex>}

Enter the DHCP option-82 Circuit ID of the client that will get the reserved IP address. The circuit-id format is controlled by the circuit-id-type setting. This option is only available when type is set to option82.

circuit-id-type {hex | string}

Select whether the format of circuit-id is hexadecimal or string. This option is only available when type is set to option82.

description <string>

Enter a description of this entry.

ip <xxx.xxx.xxx.xxx>

Enter the IPv4 address to be reserved for the MAC address. This option is only available when action is set to reserved.

mac <xx:xx:xx:xx:xx:xx>.

Enter the MAC address of the client that will get the reserved IP address. This option is only available when type is set to mac.

remote-id {<string> | <hex>}

Enter the DHCP option-82 Remote ID of the client that will get the reserved IP address. This option is only available when type is set to option82.

remote-id-type {hex | string}

Select whether the format of remote-id is hexadecimal or string. This option is only available when type is set to option82.

cache-notfound-responses {enable | disable}

Enable to cache NOTFOUND responses from the DNS server.

dns-cache-limit <integer>

Set maximum number of entries in the DNS cache.

dns-cache-ttl <int>

Enter the duration, in seconds, that the DNS cache retains information.

domain <domain_name>

Set the local domain name (optional).

ip6-primary <dns_ipv6>

Enter the primary IPv6 DNS server IP address.

ip6-secondary <dns_ip6>

Enter the secondary IPv6 DNS server IP address.

primary <dns_ipv4>

Enter the primary DNS server IP address.

secondary <dns_ip4>

Enter the secondary DNS IP server address.

collector-ip <IPv4_address>

Enter the IP address for the collector.

The default is 0.0.0.0. Setting the value to “0.0.0.0” or “” disables this feature. The format is xxx.xxx.xxx.xxx.

collector-port <port_number>

Enter the port number for the collector.

The range of values is 0-65535. The default port for NetFlow is 2055; the default port for IPFIX is 4739.

format {netflow1 | netflow5 | netflow9 | ipfix}

You can set the format of the exported flow data as NetFlow version 1, NetFlow version 5, NetFlow version 9, or IPFIX sampling.

NOTE: When the export format is NetFlow version 5, the sample rate used in the exported packets is derived from the lowest port number where sampling is enabled. Fortinet recommends that administrators using NetFlow version 5 set the sample rate consistently across all ports.

identity <hexadecimal>

Required. Enter a unique number to identify which FortiSwitch unit the data originates from. The range of values is 0x00000000-0xFFFFFFFF. If identity is not specified, the “Burn in MAC” value is used instead (see get system status).

level {ip | mac | port | proto | vlan}

You can set the flow-tracking level to one of the following: - ip—The FortiSwitch unit collects the source IP address and destination IP address from the sample packet.

• mac—The FortiSwitch unit collects the source MAC address and destination MAC address from the sample packet.
• port—The FortiSwitch unit collects the source IP address, destination IP address, source port, destination port, and protocol from the sample packet.
• proto—The FortiSwitch unit collects the source IP address, destination IP address, and protocol from the sample packet.
• vlan—The FortiSwitch unit collects the source IP address, destination IP address, source port, destination port, protocol, and VLAN from the sample packet.

max-export-pkt-size <integer>

Set the maximum size in bytes of exported packets in the application level. The range of values is 512-9216.

timeout-general <integer>

Set the general timeout in seconds for the flow session. The range of values is 60-604800.

timeout-icmp <integer>

Set the ICMP timeout for the flow session. The range of values is 60-604800.

timeout-max <integer>

Set the maximum number of seconds before the flow session times out. The range of values is 60-604800.

timeout-tcp <integer>

Set the TCP timeout for the flow session. The range of values is 60-604800.

timeout-tcp-fin <integer>

Set the TCP FIN flag timeout for the flow session. The range of values is 60-604800.

timeout-tcp-rst <integer>

Set the TCP RST flag timeout for the flow session. The range of values is 60-604800.

timeout-udp <integer>

Set the UDP timeout for the flow session. The range of values is 60-604800.

transport {sctp | tcp | udp}

You can set exported packets to use UDP, TCP, or SCTP for transport.

<id>

Enter the identifier.

interval <integer>

The time in seconds allowed for domain name system (DNS) resolution. The value range is 3-300 seconds.

name <string>

The domain name for the FortiSwitch Cloud.

port <port_number>

Port number used to connect to the FortiSwitch Cloud.

802.1x-ca-certificate {Entrust_802.1x_CA | Entrust_802.1x_G2_CA | Entrust_802.1x_L1K_CA | Fortinet_CA | Fortinet_CA2}

• Entrust_802.1x_CA—Select this CA if you are using 802.1x authentication.
• Entrust_802.1x_G2_CA—Select this CA if you want to use the Google Internet Authority G2.
• Entrust_802.1x_L1K_CA—Select this CA if you want to use http://ocsp.entrust.net.
• Fortinet_CA—Select this CA if you want to use the factory-installed certificate.
• Fortinet_CA2—Select this CA if you want to use the factory-installed certificate.

802.1x-certificate {Entrust_802.1x | Fortinet_Factory | Fortinet_Factory2 | Fortinet_Firmware}

• Entrust_802.1x—This certificate is embedded in the firmware and is the same on every unit (not unique). It has been signed by a public CA. This is the default certificate for 802.1x authentication.
• Fortinet_Factory—This certificate is embedded in the hardware at the factory and is unique to this unit. It has been signed by a proper CA.
• Fortinet_Factory2—This certificate is embedded in the hardware at the factory and is unique to this unit. It has been signed by a proper CA.
• Fortinet_Firmware—This certificate is embedded in the firmware and is the same on every unit (not unique). It has been signed by a proper CA. It is not recommended to use it for server-type functionality since any other unit could use this same certificate to spoof the identity of this unit.

admin-concurrent {enable | disable}

Enable to enforce concurrent administrator logins. When enabled, the FortiSwitch restricts concurrent access from the same admin user name but on different IP addresses. Use policy-auth-concurrent for firewall authenticated users.

admin-https-pki-required {enable | disable}

Enable to allow user to log in by providing a valid certificate if PKI is enabled for HTTPS administrative access. The default setting of disable allows admin users to log in by providing a valid certificate or password.

admin-https-ssl-versions {tlsv1-0 | tlsv1-1 | tlsv1-2 | tlsv1-3}

Set the allowed SSL/TLS versions for Web administration.

admin-lockout-duration <time_int>

Set the administration account’s lockout duration in seconds for the firewall. Repeated failed login attempts will enable the lockout. Use admin-lockout-threshold to set the number of failed attempts that will trigger the lockout.

admin-lockout-threshold

<failed_int>

Set the threshold, or number of failed attempts, before the account is locked out for the admin-lockout-duration.

admin-port <port_number>

Enter the port to use for HTTP administrative access.

admin-scp {enable | disable}

Enable to allow system configuration download by the secure copy (SCP) protocol.

admin-server-cert

{self-sign | Entrust_802.1x | Fortinet_Factory | Fortinet_Factory2 | Fortinet_Firmware}

• self-sign—Use a self-signed security certificate. Self-signed certificates are free and will encrypt the data just as securely as a purchased certificate. Self-signed certificates, however, are not likely to be recognized by the CA certificate store so will be considered by any checks against that store as invalid.
• Entrust_802.1x—This certificate is embedded in the firmware and is the same on every unit (not unique). It has been signed by a public CA.
• Fortinet_Factory—This certificate is embedded in the hardware at the factory and is unique to this unit. It has been signed by a proper CA.
• Fortinet_Factory2—This certificate is embedded in the hardware at the factory and is unique to this unit. It has been signed by a proper CA.
• Fortinet_Firmware—This certificate is embedded in the firmware and is the same on every unit (not unique). It has been signed by a proper CA. It is not recommended to use it for server-type functionality since any other unit could use this same certificate to spoof the identity of this unit.

admin-sport <port_number>

Enter the port to use for HTTPS administrative access.

admin-ssh-grace-time

<time_int>

Enter the maximum time permitted between making an SSH connection to the FortiSwitch and authenticating. Range is 10 to 3600 seconds.

admin-ssh-port <port_number>

Enter the port to use for SSH administrative access.

admin-ssh-v1 {enable | disable}

Enable compatibility with SSH v1.0.

admin-telnet-port

<port_number>

Enter the port to use for telnet administrative access.

admintimeout <admin_timeout_minutes>

Set the number of minutes before an idle administrator times out. This controls the amount of inactive time before the administrator must log in again. The maximum admintimeout interval is 480 minutes (8 hours).

To improve security, keep the idle timeout at the default value of 5 minutes.

alertd-relog {enable | disable}

Enable or disable re-logs when a sensor exceeds its threshold.

alert-interval

NOTE: This command is only available after the alertd-relog option has been enabled.

Set how often an alert is generated for temperature sensors when they exceed their set thresholds.

allow-subnet-overlap {enable | disable}

Use this command to allow two interfaces to include the same IP address in the same subnet. The command applies only between the mgmt interface and an internal interface.

Note: Different interfaces cannot have overlapping IP addresses or subnets.

Caution: For advanced users only. Use this only for existing network configurations that cannot be changed to eliminate IP address overlapping.

arp-timeout <seconds>

Set the number of seconds before dynamic ARP entries are removed from the cache.

asset-tag

LLDP uses the asset tag to help identify the unit. The asset tag can be up to 32 characters, and will be added to the LLDP-MED inventory TLV (when that TLV is enabled).

cfg-save {automatic | manual | revert}

• automatic automatically save the configuration after every change.
• manual manually save the configuration using the execute acl key-compaction command.
• revert manually save the current configuration and then revert to that saved configuration after cfg-revert-timeout expires.

clt-cert-req {enable | disable}

Enable or disable the requirement to have a client certificate to log in to the GUI.

csr-ca-attribute {enable | disable}

Enable to use the CA attribute in your certificate. Some CA servers reject CSRs that have the CA attribute.

daily-restart {enable | disable}

Enable to restart the FortiSwitch every day.

The time of the restart is controlled by restart-time.

detect_ip_conflict {enable | disable}

Enable the Detect IP Conflict feature.

dhcp-client-location {description | hostname | intfname | mode | vlan}

• description—Include the interface description.
• hostname—Include the host name.
• intfname—Include the interface name.
• mode—Include the mode.
• vlan—Include the VLAN.

dhcp-option-format {ascii | legacy}

• ascii—This format allows the user to choose the values for the circuit-id and remote-id fields.
• legacy—This format generates a predefined fixed format for the circuit-id and remote-id fields.

dhcp-remote-id {hostname | ip | mac}

• hostname—Include the host name.
• ip—Include the IP address.
• mac—Include the MAC address.

dhcp-server-access-list {enable | disable}

Set to disable for DHCP snooping to allow any DHCP server from trusted interfaces. Set to enable for DHCP snooping to allow only DHCP servers that are included in the allowed server list.

dhcp-snoop-client-req {drop-untrusted | forward-untrusted}

• drop-untrusted—Client packets are broadcasted on trusted ports in the VLAN.
• forward-untrusted—By default, client packets are broadcasted on all ports in the VLAN.

dhcps-db-exp <number_of_seconds>

Set the number of seconds for a DHCP-snooping server database entry to be kept.The range of values is 300-259200.

dhcps-db-per-port-learn-limit <number_of_entries>

Set the maximum number of DHCP server entries that are learned per interface. The range of values is 0-1024.

dst {enable | disable}

Enable or disable daylight saving time.

If you enable daylight saving time, the FortiSwitch unit adjusts the system time when the time zone changes to daylight saving time and back to standard time.

hostname <unithostname>

Enter a name to identify this FortiSwitch unit. A hostname can only include letters, numbers, hyphens, and underlines. No spaces are allowed.

While the hostname can be longer than 16 characters, if it is longer than 16 characters it will be truncated and end with a “~” to indicate it has been truncated. This shortened hostname will be displayed in the CLI, and other locations the hostname is used.

Some models support hostnames up to 35 characters.

By default the hostname of your system is its serial number which includes the model.

image-rotation {enable | disable}

Enable or disable the rotation of the partition used to upgrade the FortiSwitch image.

ip-conflict-ignore-default {enable | disable}

Enable or disable IP conflict detection for the default IP address.

ipv6-accept-dad <0 | 1 | 2>

Specify whether to accept IPv6 duplicat address detection (DAD). Set to 0 to disable DAD. Set to 1 to enable DAD. Set to 2 to enable DAD and disable IPv6 operation if a MAC-based duplicate link-local address is found.

ipv6-all-forwarding {enable | disable

Enable or disable IPv6 forwarding.

kernel-crashlog {enable | disable}

Enable or disable whether to log a kernel crash.

l3-host-expiry {enable | disable}

Enable or disable layer-3 host expiry.

language <language>

Set the display language. You can set <language> to one of english, french, japanese, korean, portuguese, spanish, simch (Simplified Chinese) or trach (Traditional Chinese).

ldapconntimeout <ldaptimeout_msec>

LDAP connection timeout in msec

private-data-encryption {enable | disable}

Enable or disable private data encryption using an AES 128-bit key.

radius-coa-port <port_number>

Set the port number to be used for the RADIUS change of authorization (CoA).

radius-port <radius_port>

Change the default RADIUS port. The default port for RADIUS traffic is 1812. If your RADIUS server is using port 1645 you can use the CLI to change the default RADIUS port on your system.

remoteauthtimeout

<timeout_sec>

The number of seconds that the FortiSwitch waits for responses from remote RADIUS, LDAP, or TACACS+ authentication servers. The range is 0 to 300 seconds, 0 means no timeout.

To improve security keep the remote authentication timeout at the default value of 5 seconds. However, if a RADIUS request needs to traverse multiple hops or several RADIUS requests are made, the default timeout of 5 seconds may not be long enough to receive a response.

revision-backup-on-logout {disable | enable}

Enable or disable backing up the latest configuration revision when the administrator logs out of the CLI or Web GUI.

revision-backup-on-upgrade {enable | disable}

Enable or disable backing up the latest configuration revision when the administrator starts an upgrade.

strong-crypto {enable | disable}

Strong encryption and only allow strong ciphers (AES, 3DES) and digest (SHA1) for HTTPS/SSH admin access. When strong encryption is enabled, HTTPS is supported by the following web browsers: Netscape 7.2, Netscape 8.0, Firefox, and Microsoft Internet Explorer 7.0 (beta).

NOTE: Microsoft Internet Explorer 5.0 and 6.0 are not supported in strong encryption.

switch-mgmt-mode {fortilink | local}

Determines whether the switch is being managed locally, or managed by a FortiGate through a FortiLink connection.

tcp-mss-min <48-10000>

Enter the minimum allowed TCP MSS value in bytes.

tcp6-mss-min <48-10000>

Enter the minimum allowed TCP MSS value in bytes.

<interface_name>

Edit an existing interface or create a new VLAN interface.

allowaccess <access_types>

Enter the types of management access permitted on this interface or secondary IP address. Valid types are:

http https ping radius-acct snmp ssh telnet.

Separate each type with a space.

To add or remove an option from the list, retype the complete list as required.

alias <name_string>

Enter an alias name for the interface. Once configured, the alias will be displayed with the interface name to make it easier to distinguish. The alias can be a maximum of 25 characters. This option is only available when interface type is physical.

bfd {enable | disable | global}

• enable — enable BFD and ignore global BFD configuration.
• disable — disable BFD on this interface.
• global — use the BFD configuration in system settings for the virtual domain to which this interface belongs.

bfd-desired-min-tx <interval_msec>

Enter the minimum desired interval for the BFD transmit interval. Valid range is from 1 to 100 000 msec. This option is available only when bfd is enabled.

bfd-detect-mult <multiplier>

Select the BFD detection multiplier. This option is available only when bfd is enabled.

bfd-required-min-rx <interval_msec>

Enter the minimum required interface for the BFD receive interval. Valid range is from 1 to 100 000 msec. This is available only when bfd is enabled.

description <text>

Optionally, enter up to 63 characters to describe this interface.

dhcp-relay-service {enable | disable}

Enable to provide DHCP relay service on this interface. The DHCP type relayed depends on the setting of dhcp-relay-type.

There must be no other DHCP server of the same type (regular or ipsec) configured on this interface.

dhcp-relay-ip <dhcp_relay1_ipv4> {... <dhcp_relay8_ipv4>}

Set DHCP relay IP addresses. You can specify up to eight DHCP relay servers for DHCP coverage of subnets. Replies from all DHCP servers are forwarded back to the client. The client responds to the offer it wants to accept.

Do not set dhcp-relay-ip to 0.0.0.0. This option is available only when dhcp-relay-service is enabled.

dhcp-relay-option82 {enable | disable}

Enable to allow option-82 insertion in the DHCP relay. This option is available only when dhcp-relay-service is enabled.

dhcp-vendor-specific-option <string>

Set the value for DHCP vendor-specific option 43.

external {enable | disable)

Enable to indicate that an interface is an external interface connected to an external network. This option is used for SIP NAT when the config VoIP profile SIP contact-fixup option is disabled.

fail-detect {enable | disable}

Enable interface failure detection.

fail-detect-option {link-down | detectserver}

Select whether the system detects interface failure by port detection (link-down) or ping server (detectserver). This option is available only when fail-detect is enabled.

fail-alert-method

{link‑down | link‑failed‑signal}

Select the signal that the system uses to signal the link failure: Link Down or Link Failed. This option is available only when fail-detect is enabled.

fail-alert-interfaces {port1 port2 ...}

Select the interfaces to which failure detection applies. This option is available only when fail-detect is enabled.

icmp-redirect {enable | disable}

Disable to stop ICMP redirect from sending from this interface. ICMP redirect messages are sent by a router to notify the original sender of packets that there is a better route available.

interface <interface_name>

Enter the name of the interface. This option is available ony when vlanid is set.

ip <interface_ipv4mask>

Enter the interface IP address and netmask. This option is not available if mode is set to dhcp. You can set the IP and netmask, but they are not displayed. This is only available in NAT/Route mode. The IP address cannot be on the same subnet as any other interface.

log {enable | disable}

Enable or disable traffic logging of connections to this interface. Traffic will be logged only when it is on an administrative port. All other traffic will not be logged. Enabling this setting may reduce system performance, and is normally used only for troubleshooting.

mode <interface_mode>

Configure the connection mode for the interface as one of:

• static — configure a static IP address for the interface.
• dhcp — configure the interface to receive its IP address from an external DHCP server.

dhcp-client-identifier

Override the default DHCP client identifier used by this interface. The DHCP client identifier is used by DHCP to identify individual DHCP clients (in this case individual interfaces). By default, the DHCP client identifier for each interface is created based on the model name and the interface MAC address. In some cases, you might want to specify your own DHCP client identifier using this command. This option is available only when the mode is set to dhcp.

distance <1-255>

Enter the distance of learned routes.

This command is available only when mode is set to dhcp.

defaultgw {enable | disable}

Enable to get the gateway IP address from the DHCP server. This option is available only when the mode is set to dhcp.

dns-server-override {enable | disable}

Disable to prevent this interface from using DNS server addresses it acquires by DHCP. This option is available only when the mode is set to dhcp.

mtu-override {enable | disable}

Select enable to use custom MTU size instead of default (1 500). This is available only for physical interfaces and some tunnel interfaces (not IPsec). If you change the MTU size, you must reboot the FortiSwitch to update the MTU values of the VLANs on this interface. Some models support MTU sizes larger than the standard 1 500 bytes.

secondary-IP {enable | disable}

Enable to add a secondary IP address to the interface. This option must be enabled before configuring a secondary IP address. When disabled, the Web-based manager interface displays only the option to enable secondary IP.

snmp-index <integer>

Configure the SNMP index

src-check {disable | loose | strict}

Set to disable if you do not want to use unicast reverse-path forwarding (uRPF).

Set to strict to ensure that the packet was received on the same interface that the router uses to forward the return packet.

Set to loose to ensure that the routing table includes the source IP address of the packet.

src-check-allow-default {enable | disable}

If you disable the src-default-route-check option, the packet is dropped if the source IP address is not found in the routing table. If you enable the src-default-route-check option, the packet is allowed even if the source IP address is not found in the routing table, but the default route is found in the routing table.

This option is available only when src-check is set to loose.

status {down | up}

Start or stop the interface. If the interface is stopped, it does not accept or send packets. If you stop a physical interface, associated virtual interfaces such as VLAN interfaces will also stop.

type {loopback | vlan}

• loopback — a virtual interface that is always up. This interface’s status and link status are not affected by external changes. It is primarily used for blackhole routing - dropping all packets that match this route. This route is advertised to neighbors through dynamic routing protocols as any other static route. loopback interfaces have no dhcp settings, no forwarding, no mode, or dns settings. You can create a loopback interface from the CLI or Web-based manager.
• vlan — a virtual LAN interface. This is the type of interface created by default on any existing physical interface. VLANs increase the number of network interfaces beyond the physical connections on the system. VLANs cannot be configured on a switch mode interface in Transparent mode.

vlanid <id_number>

Enter a VLAN ID that matches the VLAN ID of the packets to be received by this VLAN subinterface. The VLAN ID can be any number between 1 and 4094, as 0 and 4095 are reserved, but it must match the VLAN ID added by the IEEE 802.1Q-compliant router on the other end of the connection. Two VLAN subinterfaces added to the same physical interface cannot have the same VLAN ID. However, you can add two or more VLAN subinterfaces with the same VLAN ID to different physical interfaces, and you can add more multiple VLANs with different VLAN IDs to the same physical interface. This is available only when editing an interface with a type of VLAN.

<interface_name>

Edit an existing interface or create a new VLAN interface.

ip6-address <ipv6_netmask>

The interface IPv6 address and netmask. The format for IPv6 addresses and netmasks is described in RFC 3513.

This command is only available in NAT/Route mode.

ip6-allowaccess <access_types>

Enter the types of management access permitted on this IPv6 interface. Valid types are: fgfm, http, https, ping, snmp, ssh, and telnet. Separate the types with spaces. If you want to add or remove an option from the list, retype the list as required.

autoconf {disable | enable}

Enable or disable the automatic address configuration.

ip6-unknown-mcast-to-cpu {disable | enable}

Enable or disable the sending of unknown multicast addresses to the CPU.

ip6-mode {dhcp | static}

Set the addressing mode to be static or DHCP.

DHCP addressing mode is available only when autoconf is disabled.

ip6-dns-server-override {disable | enable}

Enable or disable using the DNS server acquired by DHCP.

This command is available only when the ip6-mode is set to dhcp.

dhcp6-information-request {disable | enable}

Enable or disable the DHCPv6 infomation request.

ip6-send-adv {disable | enable}

Enable or disable the sending of the IPv6 router advertisement.

This command is only available when autoconf is disabled.

ip6-manage-flag {disable | enable}

Enable or disable the sending of the IPv6 managed flag.

ip6-other-flag {disable | enable}

Enable or disable the sending of the IPv6 other flag.

ip6-max-interval <4-1800>

Specify the maximum number of seconds before the RA is sent.

ip6-min-interval <3-1350>

Specify the minium number of seconds before the RA is sent.

ip6-link-mtu <integer>

Specify the IPv6 link maximum transmission unit.

ip6-reachable-time <0-3600000>

Specify the IPv6 reachable time in milliseconds.

ip6-retrans-time <0-2147483647>

Specify the IPv6 retransmit time in milliseconds.

ip6-default-life <0-9000>

Specify the IPv6 default life in seconds.

ip6-hop-limit <0-255>

Specify the maximum number of IPv6 hops.

vrip6_link_local {enable | disable}

Enter the link-local IPv6 address of virtual router.

vrrp-virtual-mac6 {enable | disable}

Enable VRRP virtual MAC addresses for the IPv6 VRRP routers added to this interface. See RFC 5798 for information about the VRRP virtual MAC addresses.

<prefix_ipv6>

IPv6 address prefix. Configure addditonal IPv6 prefixes for this IPv6 interface.

<prefix_ipv6>

IPv6 advertised prefix list. Configure which IPv6 prefixes are advertised..

autonomous-flag {disable | enable}

Enable or disable the autonomous flag.

onlink-flag {disable | enable}

Enable or disable the onlink flag.

preferred-life-time <0-2147483647>

Specify the preferred lifetime in seconds for the advertised IPv6 prefix.

<interface_name>

Edit an existing interface or create a new VLAN interface.

<id>

Identifier.

ip <IP_address_and_netmask>

Enter the IP address and netmask.

<interface_name>

Edit an existing interface or create a new VLAN interface.

<VRID_int>

VRRP virtual router ID (1 to 255). Identifies the VRRP virtual router.

adv-interval <seconds_int>

VRRP advertisement interval (1-255 seconds).

preempt {enable | disable}

Enable or disable VRRP preempt mode. In preempt mode a higher priority backup system can preempt a lower priority master system.

priority <prio_int>

Priority of this virtual router (1-255). The VRRP virtual router on a network with the highest priority becomes the master.

start-time <seconds_int>

The startup time of this virtual router (1-255 seconds). The startup time is the maximum time that the backup system waits between receiving advertisement messages from the master system.

status {enable | disable}

Enable or disable this virtual router.

version {2 | 3}

Set the VRRP version to VRRP version 2 or VRRP version 3.

vrdst <ipv4_addr>

Monitor the route to this destination.

vrgrp <integer>

VRRP group identifier. The value range is 1-65535.

<id>

Enter a unique integer to create a new entry.

interface <interface_name>

Required. Enter the interface.

ipv6 <IPv6_address>

Enter the IPv6 addresss in the following format:

xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx

<link monitor name>

Enter the link monitor name.

addr-mode {ipv4 | ipv6}

Select whether to use IPv4 or IPv6 addresses.

srcintf <string>

Interface where the monitor traffic is sent.

protocol {arp | ping}

Protocols used to detect the server. Select ARP or ping.

gateway-ip <IPv4 address>

Gateway IPv4 address used to PING the server. This option is available only when addr-mode is set to ipv4.

gateway-ip6 <IPv6 address>

Gateway IPv6 address used to PING the server. This option is available only when addr-mode is set to ipv6.

source-ip <IPv4 address>

Source IPv4 address used in packet to the server. This option is available only when addr-mode is set to ipv4.

source-ip6 <IPv6 address>

Source IPv6 address used in packet to the server. This option is available only when addr-mode is set to ipv6.

interval <integer>

Detection interval in seconds. The range is 1-3600.

timeout <integer>

Detect request timeout in seconds. The range is 1-255.

failtime <integer>

Number of retry attempts before bringing server down. The range is 1-10.

recoverytime <integer>

Number of retry attempts before bringing server up. The range is 1-10.

update-static-route {enable | disable}

Enable or disable update static route.

<name>

Enter a unique name for the location entry.

additional <string>

Enter additional location information, for example, west wing.

additional-code <string>

Enter the additional country-specific code for the location. In Japan, use the Japan Industry Standard (JIS) address code.

block <string>

Enter the neighborhood (Korea) or block.

branch-road <string>

Enter the branch road name. This value is used when side streets do not have unique names so that both the primary road and side street are used to identify the correct road.

building <string>

Enter the name of the building (structure) if the address includes more than one building, for example, Law Library.

city <string>

Enter the city (Germany), township, or shi (Japan).

city-division <string>

Enter the city division, borough, city district (Germany), ward, or chou (Japan).

country <string>

Enter the two-letter ISO 3166 country code in capital ASCII letters, for example, US, CA, DK, and DE.

country-subdivision <string>

Enter the national subdivision (such as state, canton, region, province, or prefecture). In Canada, the subdivision is province. In Germany, the subdivision is state. In Japan, the subdivision is metropolis. In Korea, the subdivision is province. In the United States, the subdivision is state.

county <string>

Enter the county (Canada, Germany, Korea, and United States), parish, gun (Japan), or district (India).

direction <string>

Enter N, E, S, W, NE, NW, SE, or SW for the leading street direction.

floor <string>

Enter the floor number, for example, 4.

landmark <string>

Enter the nickname, landmark, or vanity address, for example, UC Berkeley.

language <string>

Enter the ISO 639 language code used for the address information.

name <string>

Enter the person or organization associated with the address, for example, Fortinet or Textures Beauty Salon.

number <string>

Enter the street address, for example, 1560.

number-suffix <string>

Enter any modifier to the street address. For example, if the full street address is 1560A, enter 1560 for the number and A for the number-suffix.

place-type <string>

Enter the type of place, for example, home, office, or street.

post-office-box <string>

Enter the post office box, for example, P.O. Box 1543. When the post-office-box value is set, the street address components are replaced with this value.

postal-community <string>

Enter the postal community name, for example, Alviso. When the postal-community name is set, the civic community name is replaced by this value.

primary-road <string>

Enter the primary road or street name for the address.

road-section <string>

Enter the specific section or stretch of a primary road. This field is used when the same street number appears more than once on the primary road.

room <string>

Enter the room number, for example, 7A.

script <string>

Enter the script used to present the address information, for example, Latn.

seat <string>

Enter the seat number in a stadium or theater or a cubicle number in an office or a booth in a trade show.

street <string>

Enter the street (Canada, Germany, Korea, and United States).

street-name-post-mod <string>

Enter an optional part of the street name that appears after the actual street name. If the full street name is East End Avenue Extended, the street-name-post-mod is Extended.

street-name-pre-mod <string>

Enter an optional part of the street name that appears before the actual street name. If the full street name is Old North First Street, the street-name-pre-mod is Old.

street-suffix <string>

Enter the type of street, for example, Ave or Place. Valid values are listed in the United States Postal Service Publication 28 [18], Appendix C.

sub-branch-road <string>

Enter the name of a street that branches off of a branch road. This value is used when the primary road, branch road, and subbranch road names are needed to identify the correct street.

trailing-str-suffix <string>

Enter N, E, S, W, NE, NW, SE, or SW for the trailing street direction.

unit <string>

Enter the unit (apartment or suite), for example, Apt 27.

zip <string>

Enter the postal or zip code for the address, for example, 94089-1345.

altitude <string>

Enter the vertical height of a location using the altitude-unit to specify the unit used. The format is +/- floating point number, for example, 117.47.

altitude-unit {f | m}

Select whether the altitude is measured in m (meters) or f (floors).

datum {NAD83 | NAD83/MLLW | WGS84}

Select which map is used for the location: WGS84, NAD83, or NAD83/MLLW.

latitude <string>

Enter the latitude. The format is floating point starting with +/- or ending with N/S, for example, +/-16.67 or 16.67N.

longitude <string>

Enter the longitude. The format is floating point starting with +/- or ending with E/W, for example, +/-26.789 or 26.789E.

allow-unsync-source {enable | disable}

Enable or disable whether an unsynchronized NTP server source is allowed.

authentication {enable | diable}

Enable or disable authentication.

log-time-adjustments {enable | disable}

Enable or disable whether FortiSwitch logs when NTP adjusts the system time.

ntpsync {enable | disable}

Enable or disable whether the system time is synchronized with the NTP server.

source-ip <ipv4_addr>

Enter the source IPv4 address for communication with the NTP server.

source-ip6 <ipv6_addr>

Enter the source IPv6 address for communication with the NTP server.

syncinterval <interval_int>

Enter the interval in minutes between contacting the NTP server to synchronize time. The range is from 1 to 1,440 minutes.

This option is availabe only when ntpsync is enabled.

<serverid_int>

Enter the number for this NTP server entry.

authentication {enable | diable}

Enable or disable authentication. If you enable authenication and use the NTPv3 protocol, MD5 authentication is used. If you enable authentication and use the NTPv4 protocol, SHA1 authentication is used.

key <string>

If authentication is enabled, enter a key for authentication.

key-id <integer>

If authentication is enabled, enter a key identifier for authentication.

ntpv3 {enable | disable}

Enable this option to use the NTPv3 protocol. Disable this option to use the NTPv4 protocol.

status enable

Enable password policy. The password policy cannot be disabled.

apply-to [admin‑password ipsec-preshared-key]

Select where the policy applies: administrator passwords or IPSec preshared keys. This option is available only when status is enabled.

change-4-characters {enable | disable}

Enable to require the new password to differ from the old password by at least four characters. This option is available only when status is enabled.

minimum-length <chars>

Set the minimum length of password in characters. Range 8 to 32. This option is available only when status is enabled.

min-lower-case-letter

<num_int>

Enter the minimum number of required lower case letters in every password. This option is available only when status is enabled.

min-upper-case-letter

<num_int>

Enter the minimum number of required upper case letters in every password. This option is available only when status is enabled.

min-non-alphanumeric <num_int>

Enter the minimum number of required non-alphanumeric characters in every password. This option is available only when status is enabled.

min-number <num_int>

Enter the minimum number of number characters required in every password. This option is available only when status is enabled.

expire-status {enable | disable}

Enable to have passwords expire. This option is available only when status is enabled.

<schedule_group_name>

Enter the name of the schedule group.

<schedule_name>

Enter the name of the schedule.

start <time_date>

Enter the start time and date for the schedule in the following format: hh:mm yyyy/mm/dd

<schedule_name>

Enter the name of the schedule.

day {monday | tuesday | wednesday | thursday | friday | saturday | sunday}

Enter one or more days for the ACL to be enforced. Separate days with a space.

start <time>

Enter the start time for the schedule in the following format: hh:mm

collector-ip <collector_ipv4>

The sFlow agents send sFlow datagrams to the sFlow collector at this IP address.

<profile_name>

The name of the packet-capture profile.

filter {<string> | none}

Enter none or enter the filter for selecting which packets to capture. For example, if you want packets using UDP port 1812 between hosts named forti1 and either forti2 or forti3:

'udp and port 1812 and host forti1 and \( forti2 or forti3 \)'

max-pkt-count <1-maximum>

Enter how many packets to be captured on the selected interface. The maximum number of packets that can be captured differs according to platform. See the FortiSwitchOS Adminstration Guide for details.

max-pkt-len <64-1534>

Enter the maximum packet length in bytes to be captured on the interface.

switch-interface <switch_interface_name>

Enter the switch interface name that you want to capture packets on. You cannot select both a switch interface and a system interface.

<index_number>

Enter the index number of the community in the SNMP communities table. Enter an unused index number to create a new SNMP community.

events <events_list>

Enable the events for which the system should send traps to the SNMP managers in this community.

name <community_name>

Enter the name of the SNMP community.

query-v1-port <port_number>

Enter the SNMP v1 query port number used for SNMP manager queries.

query-v1-status {enable | disable}

Enable or disable SNMP v1 queries for this SNMP community.

query-v2c-port <port_number>

Enter the SNMP v2c query port number used for SNMP manager queries.

query-v2c-status {enable | disable}

Enable or disable SNMP v2c queries for this SNMP community.

status {enable | disable}

Enable or disable the SNMP community.

trap-v1-lport <port_number>

Enter the SNMP v1 local port number used for sending traps to the SNMP managers.

trap-v1-rport <port_number>

Enter the SNMP v1 remote port number used for sending traps to the SNMP managers.

trap-v1-status {enable | disable}

Enable or disable SNMP v1 traps for this SNMP community.

trap-v2c-lport <port_number>

Enter the SNMP v2c local port number used for sending traps to the SNMP managers.

trap-v2c-rport <port_number>

Enter the SNMP v2c remote port number used for sending traps to the SNMP managers.

trap-v2c-status

{enable | disable}

Enable or disable SNMP v2c traps for this SNMP community.

<host_number>

Enter the index number of the host in the table. Enter an unused index number to create a new host.

interface <if_name>

Enter the name of the FortiSwitch interface to which the SNMP manager connects.

ip <address_ipv4>

Enter the IPv4 IP address of the SNMP manager (for hosts).

ip6 <address_ipv6>

Enter the IPv6 IP address of the SNMP manager (for hosts6).

source-ip <address_ipv4/mask>

Enter the source IPv4 IP address for SNMP traps sent by the FortiSwitch (for hosts).

contact-info <info_str>

Add the contact information for the person responsible for this FortiSwitch unit. The contact information can be up to 35 characters long.

description <description>

Add a name or description of the system. The description can be up to 35 characters long.

engine-id <engine-id_str>

• Fortinet prefix 0x8000304404
• the optional engine-id string, 24 characters maximum, defined in this command

Optionally, enter an engine-id value.

location <location>

Describe the physical location of the system. The system location description can be up to 35 characters long.

status {enable | disable}

Enable or disable the FortiSwitch SNMP agent.

trap-high-cpu-threshold

<percentage>

Enter the percentage of CPU used that will trigger the threshold SNMP trap for the high-cpu.

There is some smoothing of the high CPU trap to ensure the CPU usage is constant rather than a momentary spike. This feature prevents frequent and unnecessary traps.

trap-log-full-threshold

<percentage>

Enter the percentage of disk space used that will trigger the threshold SNMP trap for the log-full.

trap-low-memory-threshold <percentage>

Enter the percentage of memory used that will be the threshold SNMP trap for the low-memory.

trap-temp-alarm-threshold <temperature in degrees Celsius>

Set an alarm for when the system temperature reaches the specified temperature.

<user_name>

Edit or add selected user.

auth-proto {md5 | sha1 | sha224 | sha256 | sha384 | sha512}

• md5—HMAC-MD5-96 authentication protocol
• sha1—HMAC-SHA-1 authentication protocol
• sha224—HMAC-SHA-224 authentication protocol
• sha256—HMAC-SHA-256 authentication protocol
• sha384—HMAC-SHA-384 authentication protocol
• sha512—HMAC-SHA-512 authentication protocol

auth-pwd <password>

Enter the password for the authentication protocol. This option is available only when security-level is set to auth-priv or auth-no-priv.

priv-proto {aes128 | aes192 | aes192c | aes256 | aes256c | des}

• aes128—CFB128-AES-128 symmetric encryption protocol
• aes192—CFB128-AES-192 symmetric encryption protocol
• aes192c—CFB128-AES-192-C symmetric encryption protocol (required for certain clients)
• aes256—CFB128-AES-256 symmetric encryption protocol
• aes256c—CFB128-AES-256-C symmetric encryption protocol (required for certain clients)
• des—CBC-DES symmetric encryption protocol

priv-pwd <password>

Enter the password for the encryption protocol. This option is available only when security-level is set to auth-priv.

queries {enable | disable}

Enable or disable SNMP v3 queries for this user. Queries are used to determine the status of SNMP variables.

query-port <port_int>

Enter the number of the port used for SNMP v3 queries. If multiple versions of SNMP are being supported, each version should listen on a different port.