Configuring administrator tasks

You can use the default “admin” account to configure administrator accounts, adjust system settings, upgrade firmware, create backup files, and configure security features.

This chapter covers the following topics:

• Setting the time and date
• Configuring system banners
• Configuring the temperature sensor
• Setting the boot partition
• Upgrading the firmware
• Backing up the system configuration
• Remote authentication servers
• Configuring system administrators
• Configuring administrative logins
• Using PKI
• Configuring security checks
• Logging
• Fault relay support
• Using SSH and the Telnet client

Setting the time and date

For effective scheduling and logging, the system date and time must be accurate. You can either manually set the system date and time or configure the system to automatically keep its time correct by synchronizing with a Network Time Protocol (NTP) server.

NOTE: Some FortiSwitch models do not have a battery-backup real-time clock. For FortiSwitch models without a real-time clock, the time is reset when the switch is rebooted. These models must be connected to an NTP server if you want to maintain the correct system date and time.

The Network Time Protocol enables you to keep the system time synchronized with other network systems. This will also ensure that logs and other time-sensitive settings are correct.

When the system time is synchronized, polling occurs every 2 minutes. When the system time is not synchronized but the NTP server can be reached, polling is attempted every 2 seconds to synchronize quickly. If the NTP server cannot be reached, polling occurs up to every 64 seconds. If DNS cannot resolve the host name, polling occurs up to every 60 seconds.

Starting in FortiSwitchOS 6.4.0, the default Sync Interval is 10 minutes. The polling interval is one-fifth of the configured Sync Interval.

To set the date and time:

1. Go to System > Dashboard.
2. Next to the System Time field, select Change.
   
   
   
3. Select your Time Zone.
4. Either select Manual Setting and enter the system date and time or select Synchronize with NTP Server. If you select synchronization, you can either use the default FortiGuard server or specify a different server. You can also set the Sync Interval.
5. Select Update.
   

If you use an NTP server, you can identify the IPv4 or IPv6 address for this self-originating traffic with the set source-ip or set source-ip6 command. For example, you can set the source IPv4 address of NTP to be on the DMZ1 port with an IP of 192.168.4.5:

config system ntp

set authentication enable

set ntpsyn enable

set syncinterval 5

set source-ip 192.168.4.5

end

Configuring system banners

You can specify system banner messages in the CLI that will appear when users log in using either the CLI or the GUI.

You can enter up to 2,048 characters for each system banner. Currently, only text is supported. By default, no system banners are displayed.

The GUI displays the pre-login banner before you enter your user name or password:

The GUI displays the post-login banner after you enter your user name and password and select Log In:

You cannot finish logging in until you select I Agree.

The CLI displays the pre-login banner before you enter your user name. The CLI displays the post-login banner after you enter your password; you cannot finish logging in until you press a to accept the message.

To configure system banners:

config system global

set pre-login-banner "<string>"

set post-login-banner "<string>"

end

For example:

S548DF5018000776 # config system global

S548DF5018000776 (global) # set pre-login-banner "All systems will be unavailable,

> starting at midnight. Please exit all applications by then."

S548DF5018000776 (global) # set post-login-banner "Remember to exit before midnight."

S548DF5018000776 (global) # end

NOTE: For multi-line messages, just press the Return key between lines.

Configuring the temperature sensor

If your FortiSwitch unit has a temperature sensor, you can set a warning and an alarm for when the system temperature reaches specified temperatures. When these thresholds are exceeded, a log message and SNMP trap are generated. The warning threshold must be lower than the alarm threshold.

Use the following commands to set warning and alarm thresholds:

config system snmp sysinfo

set status enable

set trap-temp-warning-threshold <temperature in degrees Celsius>

set trap-temp-alarm-threshold <temperature in degrees Celsius>

end

By default, the FortiSwitch unit generates an alert (in the form of an SNMP trap and a SYSLOG entry) every 30 minutes when the temperature sensor exceeds its set threshold. You can change this interval with the following commands:

config system global

set alertd-relog enable

set alert-interval <1-1440 minutes>

end

Upgrading the firmware

Use these procedures to upgrade your FortiSwitch firmware.

Using the GUI

You can upgrade the firmware from the dashboard or from the system configuration page.

To upgrade the firmware from the dashboard:

1. Go to System > Dashboard.
2. Next to the Firmware Version field, select Update.
   
   
   

To upgrade the firmware from the system configuration page:

1. Go to System > Config > Firmware.
2. Select Choose File and then navigate to the firmware image.
   
   
3. Select Apply.
   

Using the CLI

You can download a firmware image from an FTP server, from a FortiManager unit, or from a TFTP server. The FortiSwitch unit reboots and then loads the new firmware.

execute restore image ftp <filename_str> <server_ipv4[:port_int] | server_fqdn[:port_int]>[<username_str> <password_str>]

execute restore image management-station <version_int>

execute restore image tftp <filename_str> <server_ipv4>

The following example shows how to upload a configuration file from a TFTP server to the FortiSwitch unit and restart the FortiSwitch unit with this configuration. The name of the configuration file on the TFTP server is backupconfig. The IP address of the TFTP server is 192.168.1.23.

execute restore config tftp backupconfig 192.168.1.23

You can also load a firmware image from an FTP or TFTP server without restarting the FortiSwitch unit:

execute stage image ftp <string> <ftp server>[:ftp port]

execute stage image tftp <string> <ip>

Verifying image integrity

To verify the integrity of the images in the primary and secondary (if applicable) flash partitions, use the following commands:

execute verify image primary

execute verify image secondary

If the image is corrupted or missing, the command fails with a return code of -1.

For example:

execute verify image primary

Verifying the image in flash......100%

No issue found!

execute verify image secondary

Verifying the image in flash......100%

Bad/corrupted image found in flash!

Command fail. Return code -1

Restore or upgrade the BIOS

You can restore or upgrade the basic input/output system (BIOS) if needed. After a BIOS upgrade, passwords for all FortiSwitch local users must be reconfigured using the config user local setting.

CAUTION: Only restore or upgrade the BIOS if Customer Support recommends it.

To upgrade or restore the BIOS from the CLI:

execute restore bios tftp <filename_str> <server_ipv4[:port_int]>

For example:

execute restore bios tftp PPC/FS-3032D/04000009/FS3D323Z14000004.bin 10.105.2.201

The example downloads the BIOS file from the TFTP server at the specified IPv4 address.

NOTE: If the BIOS upgrade fails, do not restart the FortiSwitch unit. Instead, try the CLI command again. If repeating the CLI command does not work, the FortiSwitch unit might require a return merchandise authorization (RMA).

Setting the boot partition

You can specify the flash partition for the next reboot. The system can use the boot image from either the primary or the secondary flash partition:

execute set-next-reboot <primary | secondary>

NOTE: You must disable image rotation before you can use the execute set-next-reboot command.

If your FortiSwitch model has dual flash memory, you can use the primary and backup partitions for image rotation. By default, this feature is enabled.

config system global

set image-rotation <enable | disable>

end

To list all of the flash partitions:

diagnose sys flash list

Backing up the system configuration

To back up the configuration from the dashboard:

1. Go to System > Dashboard.
2. Next to the System Configuration field, select Backup.
   You can enter a password to encrypt the backup file. Passwords can be up to 15 characters in length.
   
   
   

Remote authentication servers

If you are using remote authentication for administrators or users, you need to configure one of the following:

• RADIUS server
• TACACS+ server

RADIUS server

The information you need to configure the system to use a RADIUS server includes:

• the RADIUS server’s domain name or IP address
• the RADIUS server’s shared secret key

The default port for RADIUS traffic is 1812. Some RADIUS servers use port 1645. You can configure the FortiSwitch unit to use port 1645:

config system global

set radius-port 1645

end

To configure RADIUS authentication with the GUI:

1. Go to System > Authentication > RADIUS and select Add Server.
   
   
   
2. Enter the following information and select Add.

Field	Description
Name	Enter a name to identify the RADIUS server on the FortiSwitch unit.
Primary Server Address	Enter the domain name (such as fgt.example.com) or the IP address of the RADIUS server.
Primary Server Secret	Enter the server secret key, such as radiusSecret. This key can be a maximum of 16 characters long. This value must match the secret on the RADIUS primary server.
Secondary Server Name/IP	Optionally enter the domain name (such as fgt.example.com) or the IP address of the secondary RADIUS server.
Secondary Server Secret	Optionally, enter the secondary server secret key, such as radiusSecret2. This key can be a maximum of 16 characters long. This value must match the secret on the RADIUS secondary server.
Authentication Scheme	If you know the RADIUS server uses a specific authentication protocol, select Specify Authentication Protocol and select the protocol from the list. Otherwise, select Use Default Authentication Scheme. The default authentication scheme will usually work.
NAS IP/Called Station ID	Enter the IP address to be used as an attribute in RADIUS access requests. The NAS IP address is a RADIUS setting or IP address of the FortiSwitch interface used to talk to the RADIUS server, if not configured. The Called Station ID is the same value as the NAS IP address but in text format.
Include in every User Group	When this option is enabled, this RADIUS server is automatically included in all user groups. This option is useful if all users will be authenticating with the remote RADIUS server.

To configure the FortiSwitch unit for RADIUS authentication, see 802.1x authentication.

TACACS+ server

TACACS+ is a remote authentication protocol that provides access control for routers, network access servers, and other networked computing devices using one or more centralized servers. TACACS+ allows a client to accept a user name and password and send a query to a TACACS+ authentication server. The server host determines whether to accept or deny the request and sends a response back that allows or denies the user access to the network.

TACACS+ offers fully encrypted packet bodies and supports both IP and AppleTalk protocols. TACACS+ uses TCP port 49, which is seen as more reliable than RADIUS’s UDP protocol.

To configure TACACS+ authentication using the GUI:

1. Go to System > Authentication > TACACS and select Add Server.
   
   
   
2. Enter the following information and select Add.

Field	Description
Name	Enter a name to identify the TACACS server on the FortiSwitch unit.
Server Address	Enter the domain name (such as fgt.example.com) or the IP address of the TACACS server.
Server Key	Enter the server key for the TACACS server.
Authentication Type	Select the authentication type to use for the TACACS+ server. Auto tries PAP, MSCHAP, and CHAP (in that order).

To configure the FortiSwitch unit for TACACS+ authentication, see TACACS.

Configuring system administrators

In addition to the default “admin” account, you might want to set up other administrators with different levels of system access.

This section covers the following topics:

• Administrator profiles
• Creating administrator profiles
• Access control
• Adding administrators
• Monitoring administrators
• Setting the default administrator password
• Setting the password retries and lockout time
• Setting the idle timeout

Administrator profiles

Administer profiles define what the administrator user can do when logged into the FortiSwitch unit. When you set up an administrator user account, you also assign an administrator profile, which dictates what the administrator user will see. Depending on the nature of the administrator’s work, access level, or seniority, you can allow them to view and configure as much, or as little, as required.

The super_admin administrator is the administrative account that the primary administrator should have to log into the FortiSwitch unit. The profile cannot be deleted or modified to ensure there is always a method to administer the FortiSwitch unit. This user profile has access to all components of the system, including the ability to add and remove other system administrators. For some administrative functions, such as backing up and restoring the configuration using SCP, super_admin access is required.

Creating administrator profiles

To configure administrator profiles, go to System > Admin > Profiles. You can only assign one profile to each administrator user.

On the Add Profile page, you define the components of the FortiSwitch unit that will be available to view and/or edit. For example, if you configure a profile so that the administrator can only access System Configuration, this admin will not be able to change Network settings. For more detail about what is covered by each access control, see Access control.

Using the GUI:

1. Go to System > Admin > Profiles and select Add Profile.
   
   
   
2. Give the profile an appropriate name.
3. Set Access Control as required, selecting None, Read Only, or Read-Write for each line.
4. Select Add.

Using the CLI:

config system accprofile

edit <name>

set admingrp {none | read | read-write}

set loggrp {none | read | read-write}

set netgrp {none | read | read-write}

set routegrp {none | read | read-write}

set sysgrp {none | read | read-write}

end

end

Access control

The System Configuration access control applies to the following menus:

• System > Dashboard
• System > Network > DNS
• System > Network > Settings
• System > Config > SNMP > Communities
• System > Config > SNMP > Users
• System > Config > SNMP > Settings
• System > Config > Firmware
• System > Config > Backup
• System > Config > Revisions
• System > Config > Licenses
• System > Config > Time
• System > Config > SSL
• System > User > Definition
• System > User > Group
• System > Authentication > LDAP
• System > Authentication > RADIUS
• System > Authentication > TACACS
• System > Certificate > Local
• System > Certificate > Remote
• System > Certificate > Authorities
• System > Certificate > CRLs

The Network Configuration access control applies to the follow menus:

• System > Network > Interface > Physical
• System > Network > Interface > VLAN
• System > Network > Interface > Loopback
• Switch > Port > Physical
• Switch > Port > Trunk
• Switch > Interface > Physical
• Switch > Interface > Trunk
• Switch > Interface > Port Security
• Switch > STP > Settings
• Switch > STP > Instances
• Switch > Flap Guard
• Switch > LLDP-MED > Profiles
• Switch > LLDP-MED > Settings
• Switch > POE
• Switch > sFlow
• Switch > Mirror
• Switch > VLAN
• Switch > Virtual Wires
• Switch > Storm Control
• Switch > MAC Entries
• Switch > IP-MAC Binding
• Switch > QoS > 802.1p
• Switch > QoS > IP/DSCP
• Switch > QoS > Egress Policy
• Switch > Monitor > Forwarding Table
• Switch > Monitor > Port Stats
• Switch > Monitor > Spanning Tree
• Switch > Monitor > Modules
• Switch > Monitor > LLDP
• Switch > Monitor > Loop Guard
• Switch > Monitor > Flap Guard
• Switch > Monitor > 802.1x Status

The Admin Users access control applies to the following menus:

• System > Admin > Administrators
• System > Admin > Profiles
• System > Admin > Monitor
• System > Admin > Settings

The Router Configuration access control applies to the following menus:

• Router > Config > OSPF > Settings
• Router > Config > OSPF > Areas
• Router > Config > OSPF > Networks
• Router > Config > OSPF > Interfaces
• Router > Config > RIP > Settings
• Router > Config > RIP > Distances
• Router > Config > RIP > Networks
• Router > Config > RIP > Interfaces
• Router > Config > Static
• Router > Config > Interface
• Router > Config > Link Probes
• Router > Monitor > Routing
• Router > Monitor > Link

The Log & Report access control applies to the follow menus:

• Log > Event Log > Link
• Log > Event Log > POE
• Log > Event Log > Spanning Tree
• Log > Event Log > Switch
• Log > Event Log > Switch Controller
• Log > Event Log > System
• Log > Event Log > Router
• Log > Event Log > User
• Log > Config

Adding administrators

Only the default “admin” account can create a new administrator account. If required, you can add an additional account with read-write access control to add new administrator accounts.

If you log in with an administrator account that does not have the super_admin admin profile, the administrators list will show only the administrators for the current virtual domain.

When adding administrators, you are setting up the administrator’s user account. An administrator account comprises an administrator’s basic settings as well as their access profile. The access profile is a definition of what the administrator is capable of viewing and editing.

Follow one of these procedures to add an administrator.

Using the GUI:

1. Go to System > Admin > Administrators.
2. Select Add Administrator.
   
   
   
3. Enter the administrator name.
4. Select the type of account. If you select Remote, the system can reference a RADIUS or TACACS+ server.
5. If you selected Remote, select the User Group the account will access, whether wildcards are accepted, and whether the access profile group can be overridden.
6. Enter the password for the user. Passwords can be up to 64 characters in length.
7. Select Add.

Using the CLI:

config system admin

edit <admin_name>

set password <password>

set accprofile <profile_name>

end

Monitoring administrators

You can find out which administrators are logged in by looking at the System Information section of the Dashboard. The Current Administrator row shows the administrators logged in and the total logged in. Selecting Details displays the information for each administrator: where they are logging in from and how and when they logged in.

Setting the default administrator password

By default, your system has an administrator account set up with the user name admin and no password. On your first login to the GUI or CLI of a new FortiSwitch unit, you must create a password. You are also forced to create a password after resetting the FortiSwitch configuration to the factory default settings with the execute factory reset or execute factoryresetfull command.

To change the default password:

1. From the admin menu in the page banner, select Change Password.




2. Enter the new password in the Password and Confirm Password fields. Passwords can be up to 64 characters in length.
3. Select Change.

Setting the password retries and lockout time

By default, the system includes a set number of three password retries, allowing the administrator a maximum of three attempts to log into their account before they are locked out for a set amount of time (by default, 60 seconds).

The number of attempts can be set to an alternate value, as well as the default wait time before the administrator can try to enter a password again. You can also change this value to make it more difficult to hack. Both settings are must be configured with the CLI

To configure the lockout options:

config system global

set admin-lockout-threshold <failed_attempts>

set admin-lockout-duration <seconds>

end

For example, to set the lockout threshold to one attempt and the duration before the administrator can try again to log in to five minutes, enter these commands:

config system global

set admin-lockout-threshold 1

set admin-lockout-duration 300

end

Setting the idle timeout

By default, the GUI disconnects administrative sessions if no activity occurs for five minutes. This prevents someone from using the GUI if the management PC is left unattended.

To change the idle timeout:

1. Go to System > Admin > Settings.
2. Enter the time in minutes in the Idle Timeout (Minutes) field.
3. Update other settings as required:
   • TCP/UDP port values for HTTP, HTTPS, Telnet, SSH
   • Display language
4. Select Apply.

Configuring administrative logins

You can configure the RADIUS server to set the access profile. This process uses RADIUS vendor-specific attributes (VSAs) passed to the FortiSwitch unit for authorization. The RADIUS access profile override is mainly used for administrative logins.

Using the GUI:

1. Go to System > Admin > Administrators.
2. Select Add Administrator.
3. Select Remote.
   
   
4. In the Administrator field, enter a name for the RADIUS system administrator.
5. Select the user group.
6. Select Wildcard.
7. Select Accprofile Override.
8. Select Add.

Using the CLI:

The following code creates a RADIUS-system admin group with accprofile-override enabled:

config system admin

edit "RADIUS_Admins"

set remote-auth enable

set accprofile no_access

set wildcard enable

set remote-group "RADIUS_Admins"

set accprofile-override enable

next

Ensure that the RADIUS server is configured to send the appropriate VSA.

To send an appropriate group membership and access profile, set VSA 1 and VSA 6, as in the following code:

VENDOR fortinet 12356

ATTRIBUTE Fortinet-Group-Name 1 <admin profile>

ATTRIBUTE Fortinet-Access-Profile 6 <access profile>

The value of VSA 1 must match the remote group, and VSA 6 must match a valid access profile.

Using PKI

You can use Public Key Infrastructure (PKI) to require administrators to provide a valid certificate when logging in with HTTPS.

Use the following steps to configure PKI:

1. Configure a peer user.
2. Add the peer user to a user group.
3. Configure the administrator account.
4. Configure the global settings.

To configure a peer user:

config user peer

edit <peer_name>

set ca <name_of_certificate_authority>

next

end

For example:

config user peer

edit pki_peer_1

set ca Fortinet_CA

next

end

To add the peer user to a user group:

config user group

edit <group_name>

set member <peer_name>

next

end

For example:

config user group

edit pki_group_1

set member pki_peer_1

next

end

To configure the administrator account:

config system admin

edit <admin_name>

set peer-auth enable

set peer-group <group_name>

next

end

For example:

config system admin

edit pki_admin_1

set peer-auth enable

set peer-group pki_group_1

next

end

To configure the global settings:

config system gobal

set admin-https-pki-required enable

set clt-cert-req enable

end

Configuring security checks

You can enable various security checks for incoming TCP/UDP packets. The packet is dropped if the system detects the specified condition. Use the appropriate syntax for your FortiSwitch model:

• Syntax (for model FS-112D-POE)
• Syntax (for all other FortiSwitch models)

Syntax (for model FS-112D-POE)

config switch security-feature

set tcp-syn-data {enable | disable}

set tcp-udp-port-zero {enable | disable}

set tcp_flag_zero {enable | disable}

set tcp_flag_FUP {enable | disable}

set tcp_flag_SF {enable | disable}

set tcp_flag_SR {enable | disable}

set tcp_frag_ipv4_icmp {enable | disable}

set tcp_arp_mac_mismatch {enable | disable}

Variable	Description	Default
tcp-syn-data	TCP SYN packet contains additional data (possible DoS attack).	disable
tcp-udp-port-zero	TCP or UDP packet has source or destination port set to zero.	disable
tcp_flag_zero	TCP packet with all flags set to zero.	disable
tcp_flag_FUP	TCP packet with FIN, URG and PSH flag set.	disable
tcp_flag_SF	TCP packet with SYN and FIN flag set.	disable
tcp_flag_SR	TCP packet with SYN and RST flag set.	disable
tcp_frag_ipv4_icmp	Fragmented ICMPv4 packet.	disable
tcp_arp_mac_mismatch	ARP packet with MAC source address mismatch between the layer- 2 header and the ARP packet payload.	disable

Syntax (for all other FortiSwitch models)

config switch security-feature

set sip-eq-dip {enable | disable}

set tcp-flag {enable | disable}

set tcp-port-eq {enable | disable}

set tcp-flag-FUP {enable | disable}

set tcp-flag-SF {enable | disable}

set v4-first-frag {enable | disable}

set udp-port-eq {enable | disable}

set tcp-hdr-partial {enable | disable}

set macsa-eq-macda {enable | disable}

Variable	Description	Default
sip-eq-dip	TCP packet with source IP equal to destination IP.	disable
tcp_flag	DoS attack checking for TCP flags.	disable
tcp-port-eq	TCP packet with source and destination TCP port equal.	disable
tcp-flag-FUP	TCP packet with FIN, URG, and PSH flags set, and sequence number is zero.	disable
tcp-flag-SF	TCP packet with SYN and FIN flag set.	disable
v4-first-frag	DoS attack checking for IPv4 first fragment.	disable
udp-port-eq	IP packet with source and destination UDP port equal.	disable
tcp-hdr-partial	TCP packet with partial header.	disable
macsa-eq-macda	Packet with source MAC equal to destination MAC.	disable

Logging

FortiSwitchOS provides a robust logging environment that enables you to monitor, store, and report traffic information and FortiSwitch events, including attempted log ins and hardware status. Depending on your requirements, you can log to a number of different hosts.

To configure event logging using the GUI:

1. Go to Log > Config.
   
   
   
2. Under Event Type, select Enable.
3. Under Event Type, select the categories of events that you want logged.
4. Select Apply.

To configure event logging using the CLI:

config log eventfilter

set event {enable | disable}

set link {enable | disable}

set poe {enable | disable}

set router {enable | disable}

set spanning_tree {enable | disable}

set switch {enable | disable}

set switch_controller {enable | disable}

set system {enable | disable}

set user {enable | disable}

end

To view the event logs in the GUI:

1. Go to Log > Entries.
2. From the Subtype dropdown list, select the type of log entries to view.
3. From the Level dropdown list, select the severity of events to view.
4. From the User dropdown list, select which user or process generated the log entry.
5. From the User Interface dropdown list, select the IP network service that applies to the log entry.
6. From the Action dropdown list, select the event to view.
7. From the Status dropdown list, select the event result to view.

To view the event logs in the CLI:

show log eventfilter

Syslog server

Sysog is an industry standard for collecting log messages for off-site storage. You can send logs to a single syslog server. The syslog server can be configured in the GUI or CLI. Reliable syslog (RFC 6587) can be configured only in the CLI.

To configure a syslog server in the GUI:

1. Go to Log > Config.
   
   
   
2. Under Syslog, select Enable.
3. Select the severity of events to log.
4. Enter the IP address or fully qualified domain name in the Server field.
5. Enter the port number that the syslog server will use. By default, port 514 is used.
6. Select Apply.

To configure a syslog server in the CLI:

config log syslogd setting

set status enable

set server <IP address or FQDN of the syslog server>

set port <port number that the syslog server will use for logging traffic>

set facility <facility used for remote syslog>

set source-ip <source IP address of the syslog server>

end

For example, to set the source IP address of a syslog server to have an IP address of 192.168.4.5:

config log syslogd setting

set status enable

set source-ip 192.168.4.5

end

To configure a reliable syslog server in the CLI:

config log syslogd setting

set status enable

set server <IP address or FQDN of the syslog server>

set mode reliable

set port <port number that the syslog server will use for logging traffic>

set enc-algorithm {high | high-medium | low}

set certificate <certificate_used_to_communicate_with_syslog_server>

end

For example:

config log syslogd setting

set status enable

set source-ip 192.168.4.5

set mode reliable

set port 6514 // This is the default port used for reliable syslog.

set enc-algorithm high-medium

set certificate "155-sub-client"

end

Fault relay support

Fault relays are normally closed relays. When the FSR-112D-POE loses power, the relay contact is in a closed state, and the alarm circuit is triggered.

Using SSH and the Telnet client

Starting in FortiSwitchOS 6.2.0, you can use both IPv4 and IPv6 addresses with SSH and Telnet. If the IPv6 address is a link-local address, you must specify an output interface using %. For example:

execute ssh admin@fe80::926c:acff:fe7b:e059%vlan20 // vlan20 is the output interface.

execute ssh admin@172.20.120.122

execute ssh 1002::21

execute ssh 12.345.6.78

execute telnet fe80::926c:acff:fe7b:e059%vlan20 // vlan20 is the output interface.

execute telnet 1002::21

execute telnet 12.345.6.78