1

I have a Fortinet FG-60E firewall running FortiOS v6.0.1. A wireless access point is connected to one of the ports (internal3). There are currently no other clients connected to the wireless access point.

Fortinet -- WAP

Is there a FortiOS command (or commands) that will tell the MAC address of the wireless access point?

update 1

get system arp almost does what I want, except it doesn't specify the port number of the internal interface. You can see from this snippet of output:

FGT60E4Q16045123 # get system arp
Address           Age(min)   Hardware Addr      Interface
10.0.1.87         0          00:0c:29:60:8c:f4 internal
10.0.1.20         125        5c:aa:fd:1b:b5:5a internal
10.0.1.73         0          00:0c:29:a4:29:9e internal
10.0.1.96         1          00:0c:29:76:7c:2b internal
10.0.1.13         0          5c:70:a3:7d:28:82 internal
10.0.1.6          0          00:11:32:0f:ab:f9 internal
10.0.1.89         0          00:0c:29:c8:98:c4 internal
10.0.1.22         104        b8:e9:37:5f:ac:2c internal
10.0.1.75         0          00:0c:29:05:ab:42 internal
10.0.1.98         0          00:0c:29:05:53:49 internal

The interface is listed as "internal" and not "internal1", "internal2", etc.. The "internal" interface has 7 ports:

internal has 7 ports

update 2

The output from diag switch-controller dump mac-hosts-switch-port does not include the port number. Here's an example:

vd root/0  f0:9f:c2:30:d5:76  gen 159  req TOUS/2e
  created 69257s  gen 20  seen 45873s  internal  gen 79
  ip 192.168.1.1  src arp
  host 'OpenWrt'  src dhcp
vd root/0  00:0c:29:76:7c:2b  gen 1853  req TOU/2c
  created 2190525s  gen 47  seen 318s  internal  gen 1447
  ip 10.0.1.96  src arp
  host 'cdh06'  src dhcp
  server http

The first entry is the device I'm trying to identify via Fortinet CLI. As far as I can tell, there's no way to associate the MAC with a particular port on the firewall.

Improve this question
2
  • 1
    I think your problem is that you are trying to use ARP to see the interface on a switch module. For that, you need to look at the MAC address table, not the ARP table. ARP is for layer-3 to layer-2 address resolution that a layer-2 switch cares nothing about. The firewall is a layer-3 device that cares, but it is internally connected to the switch module that has layer-2 interfaces, not layer-3 interfaces.
    – Ron Maupin ♦
    Jul 27, 2018 at 23:31
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 9:10

2 Answers 2

Reset to default
1

Will diag switch mac-address list | grep -i mac help on your FG60E? I found that over there https://forum.fortinet.com/FindPost/155099

Improve this answer
2
  • Thanks @Marc. That command appears to be exactly what I'm looking for. It returns a command parse error before 'mac-address' when I try to run it. Perhaps the CLI syntax changed.
    – user49010
    Jul 28, 2018 at 16:02
  • What further command keywords are being listed when you add the question mark as in diag switch ? or diag switch-controller ?.
    – Marc 'netztier' Luethi
    Aug 3, 2018 at 5:30
1

get system arp displays the ARP table along with the interface each address has been learned from.

Edit: Of course, the ARP table is something different than the MAC table but I guess this is the closest you can get. On our 60D I can see the different VLANs, but not physical interfaces.

Also check out diag switch-controller dump mac-hosts-switch-port, but I think it's the same problem.

Edit: As far as I can see, the switch module inside the FGT-60 doesn't allow you to view its MAC table. The only thing you can see is the SoC's table and that one's limited to its internal interface to the switch module.

One a FGT-100 I can't see the physical port table either, just the hardware switch group table and its VLANs.

Improve this answer
1
  • Thanks @Zac67. That almost works, but doesn't identify the port number. I was hoping to get see the ARP cache that's specific to internal2 and not just internal. I updated the question with some sample output so you can see what I mean.
    – user49010
    Jul 27, 2018 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy