FortiSwitch

on

 

1. Factory reset

    hold on Reset button (insert the pin to the hole) 10 seconds.

2. Default login

    admin
    no password

3. default web IP
    192.168.1.99

4. Verify time and change data/time
    exe date <yyyy-mm-dd>
    execute time <hh:mm:ss>



====Fortigate Managed FortiSwitch===

1. find the mac address on a switch port

diag switch-controller mac-cache show <switch-id> <port-id>

or
define a filer

diag switch-controller mac-cache filter intf-name port1

then display the filtered port
diag switch-controller mac-cache show

when finish, clear the filter
diag switch-controller mac-cache filter clear


2. Find switch port has sticky mac enabled

show switch-controller managed-switch <switch-id> | grep sticky

show switch-controller managed-switch <switch-id> | grep -B 5 -A 2 sticky

show switch-controller managed-switch <switch-id> | grep 'sticky\|port'


3. Save or unsaved sticky mac

Unsaved (Temporary Memory): By default, newly learned sticky MAC addresses are only held in the volatile RAM. They are functional and actively enforce port security. If the FortiSwitch reboots or loses power, all unsaved sticky MACs are lost, and the port will have to relearn them from scratch upon botting.

Saved (Permanent Memory): To protect these addresses against a reboot, you must explicitly commit them to the system configuration database (CMDB). Once saved, they function like permanent static entries.

execute switch-controller switch-action sticky-mac save interface <switch-serial> <port_name>

discard unsaved mac

execute switch-controller switch-action sticky-mac delete-unsaved interface <switch-serial> <port_name>


If above command doesn't delete the cached sticky mac, then try to disable and re-enable sticky-mac.


Verify:
It is SAVED if: You see the MAC address explicitly listed in the config block like this

config switch interface
    edit "port1"
        set sticky-mac enable
        set allowed-mac 00:0c:29:ab:cd:ef  <-- (If you see this, it is SAVED)
    next
end

It is UNSAVED if: The port shows set sticky-mac enable, but there are no individual MAC addresses (allowed-mac) listed underneath it.








====Switch CLI====

1. Show a switch port configuration

show switch interface <port#>


2. Delete a MAC

diag switch mac-address delete entry <x.x.x.x.x.x> <vlan-id>

Comments

Post a Comment