How to disable unused LAN ports on Fortigate

Question

I know I can set the administrative status of WAN/DMZ ports to down to disable them, but I can only see how to set the entire internal interface up/down. Is there a way to set individual LAN ports down so someone cannot plug into them and access the network?

Answer 1

It's look like that theinternal-switch-mode is set as switch¹ (by default). That means that all port on the internal interface are configured as they are only one:

Switch mode combines FortiGate unit interfaces into one switch with one address. Interface mode gives each internal interface its own address.²

so, as I understand, if in system global configuration you set: internal-switch-mode interface, you shall configure each port independently, so you will able to reconfigure port 1 and 2 then disable the other as @David say.

NB Before switching modes, all configuration settings for the interfaces affected by the switch must be set to defaults.²

Ref:

1. Fotigate "Interface" command CLI document
2. Fotigate "Global config" command CLI document

Answer 2

This can be accomplished through the GUI by

1. navigating to System -> Network -> interface
2. select the desired interface
3. select edit for that interface
4. change "Administrative Access" to Down.

This can also be accomplished through the CLI with these commands:

config system interface

edit (desired interface)

set status down

(this works for devices running fortios)

Answer 3

You can not do this by GUI, it can be done only by CLI:

config system virtual-switch

edit internal

config port

  edit internal3
    set status down
  next

  edit internal4
     set status down
  next

end

end

end

Of course internal-switch-mode must be set to interface first.

Hope this helps.

Wlodek W.