NSE6 Part 6: FortiSwitch VLANs, RSTP, Link Aggregation, and Stacking Design

9 June 2026 NSE6 Fortinet

With FortiSwitch discovered and authorised under FortiLink, the next layer of configuration is the switching fabric: how VLANs are distributed across ports, how loops are prevented, how links are bonded for bandwidth and resilience, and how traffic is prioritised. These topics make up the bulk of the FCA-FSW exam’s intermediate-level questions.

VLAN Configuration Under FortiLink

In FortiLink managed mode, VLANs are defined on the FortiGate and pushed to FortiSwitch. You do not configure VLANs directly on the switch CLI.

Defining VLANs

VLANs are created as sub-interfaces of the FortiLink interface:

Network > Interfaces > [FortiLink interface] > Create New Sub-interface

config system interface
  edit "vlan-100"
    set vdom "root"
    set ip 10.100.0.1/24
    set interface "fortilink"
    set vlanid 100
  next
end

Each VLAN sub-interface can have a DHCP server attached, firewall policies, and an IP address for default gateway services. The FortiGate is the layer-3 gateway for all FortiSwitch-connected VLANs — FortiSwitch operates purely at layer 2.

Port profiles and VLAN assignment

Port behaviour is controlled by port profiles (switch security policies) and VLAN assignments on each physical port:

config switch-controller vlan-policy
  edit "access-vlan100"
    set vlan "vlan-100"
    set allowed-vlans "vlan-100"
    set untagged-vlans "vlan-100"
  next
end

Access port: Untagged for the assigned VLAN. The connected device sees no VLAN tag.

Trunk port: Tagged for multiple VLANs. Used for uplinks to other switches or for devices that handle VLAN tags themselves (e.g., a hypervisor).

config switch-controller managed-switch
  edit "S524DF4K15000024"
    config ports
      edit "port5"
        set vlan "vlan-100"           # native VLAN (untagged)
        set allowed-vlans "vlan-100vlan-200 vlan-300"  # tagged VLANs
      next
      edit "port24"
        # uplink port — trunk carrying all VLANs
        set allowed-vlans-all enable
      next
    end
  next
end

Native VLAN and voice VLAN

The native VLAN is the untagged VLAN on a trunk port. Traffic arriving untagged is assigned to it; traffic leaving in the native VLAN is untagged.

The voice VLAN is an additional VLAN assigned to a port specifically for IP phones detected via CDP or LLDP. The phone gets a tagged frame with the voice VLAN ID; the PC plugged into the phone’s pass-through port gets the untagged access VLAN.

config switch-controller managed-switch
  edit "S524DF4K15000024"
    config ports
      edit "port10"
        set vlan "vlan-100"           # data VLAN (untagged)
        set voice-vlan "vlan-200"     # voice VLAN (tagged)
      next
    end
  next
end

RSTP — Rapid Spanning Tree Protocol

RSTP (IEEE 802.1w) prevents loops in a switched network by blocking redundant paths while keeping them ready for fast failover.

Key concepts for the exam

Bridge ID: Each switch has a bridge ID = priority (0–61440 in steps of 4096) + MAC address. The switch with the lowest bridge ID becomes the root bridge.

Port roles:

Role	Description
Root port	The port with the best path to the root bridge (one per non-root switch)
Designated port	The forwarding port on a shared segment (one per segment)
Alternate port	Backup to the root port — immediately transitions to root port if root port fails (RSTP fast convergence)
Backup port	Backup to the designated port on the same segment

Port states (RSTP — simplified from STP):

Discarding — no forwarding, no MAC learning (replaces Blocking + Listening)
Learning — builds MAC table but does not forward
Forwarding — normal operation

RSTP convergence is typically under 1 second for direct link failures, versus STP’s 30-50 seconds.

FortiSwitch RSTP configuration

Under FortiLink, RSTP is configured per-switch:

config switch-controller managed-switch
  edit "S524DF4K15000024"
    set stp-state enable
    set stp-root-guard disable   # enable on ports facing access devices
    set stp-bpdu-guard disable   # enable on access (edge) ports
  next
end

BPDUGuard: Enabled on access (edge) ports. If a BPDU is received on an edge port (meaning a switch was plugged in where only an end device should be), the port is shut down immediately. Prevents accidental loops from unauthorized switches.

Root Guard: Enabled on ports where the root bridge should never appear. If a BPDU with a superior bridge ID arrives on a Root Guard port, the port is moved to discarding state. Prevents a rogue switch from becoming root bridge.

PortFast (edge port): Skips the learning state and goes directly to forwarding for access ports. Combine with BPDUGuard.

config switch-controller managed-switch
  edit "S524DF4K15000024"
    config ports
      edit "port5"
        set edge-port enable        # PortFast equivalent
        set stp-bpdu-guard enable   # Shut down if BPDU received
      next
    end
  next
end

FortiLink ports and STP

By default, the FortiLink uplink port on the FortiSwitch is excluded from STP to prevent FortiGate from being seen as a switching participant. This is correct — FortiGate is not a switch and should not participate in the spanning tree.

Link Aggregation

Static LAG

Multiple physical ports bundled into one logical interface. No negotiation — both ends must agree to use the same ports in the LAG.

Use case: server uplinks where you control both ends and don’t need LACP negotiation.

config switch-controller managed-switch
  edit "S524DF4K15000024"
    config ports
      edit "LAG1"
        set type trunk
        config members
          edit "port25"
          next
          edit "port26"
          next
        end
      next
    end
  next
end

Dynamic LAG (LACP)

LACP (IEEE 802.3ad) negotiates link aggregation dynamically. Each port exchanges LACP PDUs; ports that successfully negotiate join the LAG.

LACP modes:

Mode	Behaviour
Active	Initiates LACP negotiation
Passive	Responds to LACP negotiation but doesn’t initiate

At least one side must be Active. Active/Active or Active/Passive both work. Passive/Passive does nothing.

config switch-controller managed-switch
  edit "S524DF4K15000024"
    config ports
      edit "LAG1"
        set type trunk
        set lacp-mode active
        config members
          edit "port25"
          next
          edit "port26"
          next
        end
      next
    end
  next
end

MCLAG — Multi-Chassis Link Aggregation

MCLAG allows a single endpoint (server, another switch, FortiAP) to LAG across two separate FortiSwitch chassis. This provides both redundancy (chassis failure) and bandwidth aggregation.

Architecture

         Server
        /      \
    LAG port   LAG port
      |              |
  FortiSwitch-A  FortiSwitch-B
        \      /
         ICCP
       (peer link)

ICCP (Inter-Chassis Control Protocol): Carries synchronisation between the two FortiSwitch peers. Runs over the peer link.
Peer link: A physical LAG between the two switches dedicated to MCLAG synchronisation and forwarding. Must be at least 10G (ideally 25G or 40G) to avoid becoming a bottleneck.
Uplink MCLAG: The LAG from the endpoint connects to one port on each FortiSwitch peer.

MCLAG and split-brain

If the peer link fails (both switches still running, but ICCP is down), both switches believe they are the primary and start forwarding for all MACs. This causes duplicate frames. FortiSwitch handles this by:

The switch that loses the peer link (and is the secondary) disables its MCLAG member ports.
Traffic fails over entirely to the primary, avoiding duplicates.

MCLAG FortiLink (FortiGate HA)

In a FortiGate HA pair, both FortiGates connect to the same FortiSwitch (or stack of switches) via MCLAG FortiLink. This allows the FortiLink management channel to survive a FortiGate failover:

FortiGate-A ---- port1 ----\
                              FortiSwitch (MCLAG uplink to both FGTs)
FortiGate-B ---- port1 ----/

When FortiGate-A fails, FortiGate-B takes over the FortiLink management channel with no disruption to the switches.

QoS on FortiSwitch

Quality of Service ensures latency-sensitive traffic (VoIP, real-time video) is not dropped during congestion.

Trust modes

Mode	What is trusted
CoS trust	Trusts the 802.1p CoS bits in the VLAN header (3 bits, values 0–7)
DSCP trust	Trusts the DSCP field in the IP header (6 bits, 64 values)
Untrusted	Ignores marking; applies default queue

Edge ports should be set to untrusted or CoS-only — never trust DSCP from untrusted endpoints (a compromised PC could mark all its traffic as EF and starve other users).

Uplink ports typically trust DSCP (set by FortiGate or trusted devices upstream).

Egress queues

FortiSwitch supports 8 egress queues per port. The scheduler can be:

Strict Priority (SP): Queue 7 (highest) is always drained before queue 6, etc. VoIP goes in queue 7. Risk: lower queues starve if high-priority traffic is constant.
Weighted Round Robin (WRR): Each queue gets a weight. Proportional bandwidth sharing. No starvation.
SP + WRR hybrid: Top 1–2 queues are SP (for real-time), lower queues are WRR.

config switch-controller qos queue-policy
  edit "voip-priority"
    config cos-queue
      edit 7
        set description "VoIP strict priority"
        set weight 1
        set sp enable
      next
    end
  next
end

Storm control

Limits broadcast, multicast, or unknown-unicast flooding to prevent a single device from saturating the network:

config switch-controller storm-control-policy
  edit "default-storm"
    set broadcast enable
    set broadcast-rate 500     # packets per second
    set multicast enable
    set multicast-rate 500
    set unknown-unicast enable
    set unknown-unicast-rate 1000
  next
end

Diagnostic Commands

# VLAN assignments on a specific switch
diagnose switch-controller switch-info vlan <serial>

# STP state per port
diagnose switch-controller switch-info stp-instance <serial>

# LAG/trunk status
diagnose switch-controller switch-info trunk <serial>

# MCLAG peer consistency check
diagnose switch-controller switch-info mclag <serial>

# Interface counters (to spot drops, CRC errors)
diagnose switch-controller switch-info port-stats <serial>

Common Exam Scenarios

Q: Two FortiSwitches are connected together and both forward traffic, causing a broadcast storm. A: RSTP is not enabled, or both switches have the same bridge priority and neither elected a root bridge correctly. Enable RSTP and verify root bridge election with diagnose switch-controller switch-info stp-instance.

Q: MCLAG is configured but the endpoint shows only one active uplink. A: Check the LACP mode — both the endpoint LAG and the FortiSwitch MCLAG port must negotiate correctly (at least one side active). Also check the peer link status; if ICCP is down, MCLAG may not function.

Q: VoIP calls are choppy when the 10G uplink is under load. A: QoS is not configured. Set the FortiSwitch port connected to IP phones to trust CoS, map CoS 5 (VoIP) to the strict-priority egress queue, and confirm the FortiGate sets DSCP EF on VoIP traffic before it reaches the switch.