2

I know I can set the administrative status of WAN/DMZ ports to down to disable them, but I can only see how to set the entire internal interface up/down. Is there a way to set individual LAN ports down so someone cannot plug into them and access the network?

  • What type of fortinet device is it? – David Oct 27 '14 at 22:18
  • It is a Fortigate-60D. – Paul Kearney - pk Oct 28 '14 at 0:01
2

It's look like that theinternal-switch-mode is set as switch¹ (by default). That means that all port on the internal interface are configured as they are only one:

Switch mode combines FortiGate unit interfaces into one switch with one address. Interface mode gives each internal interface its own address.²

so, as I understand, if in system global configuration you set: internal-switch-mode interface, you shall configure each port independently, so you will able to reconfigure port 1 and 2 then disable the other as @David say.

NB Before switching modes, all configuration settings for the interfaces affected by the switch must be set to defaults.²

Ref:

  1. Fotigate "Interface" command CLI document
  2. Fotigate "Global config" command CLI document
0

This can be accomplished through the GUI by

  1. navigating to System -> Network -> interface
  2. select the desired interface
  3. select edit for that interface
  4. change "Administrative Access" to Down.

This can also be accomplished through the CLI with these commands:

config system interface

edit (desired interface)

set status down

(this works for devices running fortios)

  • That lets me turn down the entire internal interface (all 8 internal ports on the Fortigate-60D), but not individual ports on the internal interface. – Paul Kearney - pk Oct 28 '14 at 0:03
  • Furthering on my comment, I have a Fortigate device at a client site. I have two devices connected to internal ports 1 and 2. I want to disable ports 3-7 so that they are unusable. – Paul Kearney - pk Oct 28 '14 at 0:05
  • See @gio900's answer for how to take the device off internal switch mode – David Oct 28 '14 at 16:00
0

You can not do this by GUI, it can be done only by CLI:

config system virtual-switch

edit internal

config port

  edit internal3
    set status down
  next

  edit internal4
     set status down
  next

end

end

end

Of course internal-switch-mode must be set to interface first.

Hope this helps.

Wlodek W.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.