How to Change Switch Mode to Interface Mode in Fortigate FortiOS 5

Recently I have upgraded one of the new Fortigate 80C to FortiOS 5.0 (and recently to 5.2.1) and could not see the option to change switch mode to interface mode. Finally I have done it by CLI and let me share the way how to change switch mode to interface mode in Fortigate FortiOS 5.2, (by the way there is way in doing it in GUI mode also) Usually this option is available in web interface under settings of network ports in earlier FortiOS, like 4.0 and 3.0. But, it not available in FortiOS 5.x series including 5.2 as part of removing some of the features in web GUI interface. This change is similar to the feature removal of third party DDNS providers in latest Fortigate OS.

Fortigate is one of the best hardware device which can do lot of things in firewall, network security, internet proxy, VPN and more. You can find more information about their products, features and more technical details here in official site.

I’m not sure whether I have missed the correct place to see the option to change switch mode to interface mode in FortiOS 5 web interface, anyhow here is the way to do that in CLI ( Command Line Interface).

Change Switch Mode to Interface Mode in Fortigate FortiOS 5 and 5.2

Basically 3 steps involved in this process.

1) Complete the prerequisites to change the mode

2) Change the mode from Switch mode to interface mode

3) Configure the network and allow access to a particular network port.

 

1) Prerequisites to change the mode

You must disable DHCP service on the Fortigate device and remove the any policies related to internal interface.

Below is the Fortigate device 80C in switch mode. All interfaces are combined together as single ‘internal’ interface. In this case, we can’t have different settings ( IPs, policies etc) for every port in this device.

switch mode

a) To remove DHCP, click on the ‘internal’ and press edit. Deselect the check box of DHCP server as shown below.

disable DHCP

b) Remove any policies which are related to ‘internal’ port, normally you will find only one policy.

remove the policy

Now we are ready to change the mode.

2) Changing from Switch mode to interface mode.

As said earlier, we should use CLI to complete this task. Use serial cable and any telnet client software for this purpose. If you like to use built in telnet client of Windows 8 or 8.1, check this guide.

Login with default default credentials which username is admin and no password.

Type following command,

config system global 
  set internal-switch-mode interface 
end

cli

Once the device is rebooted, it will not have any network settings. Therefore, we must configure IP address and allowed access (http or https) to a particular network port which can be accessed through network cable and internet browser later.

 

Interface Mode in Fortigate FortiOS 5 and 5.2 in GUI/Web

Once you have completed prerequisites to change the mode, you can go to System->Network->Interfaces, then Right Click on the Internal Interface to change mode. The option will be disabled if you have some policies and DHCP servers related to it.

change mode

Even after you have changed the mode from switch mode to interface CLI or GUI web interface, one the device is rebooted you need to configure the next step by command line interface only. Follow the step 3 to allow specific access so the device can be accessed from https or http.

3) Configure the network and allow access to a network port

Earlier we have changed switch port mode to interface mode. Now the device will have n number of individual network ports which can have individual settings and policies. After changing the mode, these ports will not have any settings, even no default IP address. Use the same CLI to configure IP and allow http or https access to a particular network port so that can be accessed via network.

The following  video explains it well.

To configure the access, ( below example shows how to allow access of https and http on particular port)

config system interface
edit <interface_name>
set allowaccess http https
end

By above steps you should be able to change your Fortigate device from switch mode to interface mode in FortiOS 5 and 5.2 with CLI. This will enable you to have separate settings and configurations for every network port.

17 thoughts on “How to Change Switch Mode to Interface Mode in Fortigate FortiOS 5”

  1. Hi,
    Thankyou for the helpful info. I have another question. After changing to interface mode, the ports will have names like port1,2 etc. How can we change them back to WAN1, WAN2, internal etc for easier management?

    Thanks again.

  2. Hi, thanks for your info. I’ve seen that it’s also possible to delete the hardware switch in the interfaces overview. After deleting all correspoding policies, you can do it this way. I’ve checked this on my two Fortigate 100D, operating as a HA Cluster. Regards Chris

  3. You can change mode of the interface by

    Going into System->Network->Interfaces

    Right Click on the Internal Interface then you will see the “Change Mode” options usually it will be disabled as you have to remove the DHCP and POLICY settings as you have described above

  4. I had a problem were internal was in used, I couldn’t figure out where until i found this helpful command:

    # diagnose sys checkused sys.interface.name internal
    entry used by table system.dns-server:name ‘internal’

    then I removed it from the dns-server:

    # config system dns-server
    (dns-server) # purge
    This operation will clear all table!
    Do you want to continue? (y/n)y
    end

    Hope it helps someone…

    • I was not able to change to interface mode on one 60D until I found out that NTP server was enabled on internal. My approach to find it was: “ssh admin@my_fortigate show | grep -3 internal”

      The diag command would have been better, so thanks for the tip!

    • Thanks so much for that tip, I was starting to get annoyed because I was positive there was no policies called out for the internal interface

  5. Is it possible to configure 2 ports [outside of the WANs] for 2 web connections with fail over or load balancing between them?

    Thanks
    David

    • Based on my knowledge, there is no difference between Internal and WAN ports. You can configure internal ports to connect to internet and configure policies. It will work fine.

  6. Thanks for the article… very useful!

    I have a 90D with 16 total ports. The product specs tell me that only 2 are provisioned for WAN. Is it possible to configure an additional 2 internal ports to act as WAN ports and add them to a load balancing group?

    Thanks again!

  7. I have a Fortigate 100D.
    I was really surprised to find that the “hardware switch” in fact works as a hub broadcasting all unicast traffic on all the member physical ports.
    Could somebody please enlighten me why this is and how to change it to actual switching.
    THank you

    martin3 (at) gmail . com

  8. Christian — yes, DHCP is supported individually on each port, as they break out the same as your WAN1, WAN2, INTERNAL (which goes away) into port1, port2…port16 (or however many ports your unit has).
    You can set up a DHCP server on each of these.
    (same as you can on a VLAN interface, as well).

Comments are closed.