Recently I have upgraded one of the new Fortigate 80C to FortiOS 5.0 (and recently to 5.2.1) and could not see the option to change switch mode to interface mode. Finally I have done it by CLI and let me share the way how to change switch mode to interface mode in Fortigate FortiOS 5.2, (by the way there is way in doing it in GUI mode also) Usually this option is available in web interface under settings of network ports in earlier FortiOS, like 4.0 and 3.0. But, it not available in FortiOS 5.x series including 5.2 as part of removing some of the features in web GUI interface. This change is similar to the feature removal of third party DDNS providers in latest Fortigate OS.
Fortigate is one of the best hardware device which can do lot of things in firewall, network security, internet proxy, VPN and more. You can find more information about their products, features and more technical details here in official site.
I’m not sure whether I have missed the correct place to see the option to change switch mode to interface mode in FortiOS 5 web interface, anyhow here is the way to do that in CLI ( Command Line Interface).
Change Switch Mode to Interface Mode in Fortigate FortiOS 5 and 5.2
Basically 3 steps involved in this process.
1) Complete the prerequisites to change the mode
2) Change the mode from Switch mode to interface mode
3) Configure the network and allow access to a particular network port.
1) Prerequisites to change the mode
You must disable DHCP service on the Fortigate device and remove the any policies related to internal interface.
Below is the Fortigate device 80C in switch mode. All interfaces are combined together as single ‘internal’ interface. In this case, we can’t have different settings ( IPs, policies etc) for every port in this device.
a) To remove DHCP, click on the ‘internal’ and press edit. Deselect the check box of DHCP server as shown below.
b) Remove any policies which are related to ‘internal’ port, normally you will find only one policy.
Now we are ready to change the mode.
2) Changing from Switch mode to interface mode.
As said earlier, we should use CLI to complete this task. Use serial cable and any telnet client software for this purpose. If you like to use built in telnet client of Windows 8 or 8.1, check this guide.
Login with default default credentials which username is admin and no password.
Type following command,
config system global set internal-switch-mode interface end
Once the device is rebooted, it will not have any network settings. Therefore, we must configure IP address and allowed access (http or https) to a particular network port which can be accessed through network cable and internet browser later.
Interface Mode in Fortigate FortiOS 5 and 5.2 in GUI/Web
Once you have completed prerequisites to change the mode, you can go to System->Network->Interfaces, then Right Click on the Internal Interface to change mode. The option will be disabled if you have some policies and DHCP servers related to it.
Even after you have changed the mode from switch mode to interface CLI or GUI web interface, one the device is rebooted you need to configure the next step by command line interface only. Follow the step 3 to allow specific access so the device can be accessed from https or http.
3) Configure the network and allow access to a network port
Earlier we have changed switch port mode to interface mode. Now the device will have n number of individual network ports which can have individual settings and policies. After changing the mode, these ports will not have any settings, even no default IP address. Use the same CLI to configure IP and allow http or https access to a particular network port so that can be accessed via network.
The following video explains it well.
To configure the access, ( below example shows how to allow access of https and http on particular port)
config system interface edit <interface_name> set allowaccess http https end
By above steps you should be able to change your Fortigate device from switch mode to interface mode in FortiOS 5 and 5.2 with CLI. This will enable you to have separate settings and configurations for every network port.