From the FortiOS 5.0 onwards, changing the switch mode to interface mode in FortiGate firewall devices is different than earlier versions. I experienced this situation and could not see the option to change switch mode to interface mode at the usual place. Finally, I have done it by CLI and let me share the way how to change switch mode to interface mode in Fortigate FortiOS 6.x and 5.x (by the way there is a way to do it in GUI also). Usually, this option used to available in the web interface under settings of network ports in earlier FortiOS, like 4.0 and 3.0. But, it had been removed in the FortiOS 5.x and later versions as part of removing some of the features in the web GUI interface. This change is similar to the feature removal of third party DDNS providers in the latest Fortigate OS.
Fortigate is one of the best network security hardware device which can do a lot of things in the firewall, network security, internet proxy, VPN and more. You can find more information about their products, features and more technical details here on the official site.
Change Switch Mode to Interface Mode in Fortigate FortiOS 5.x & 6.x
In FortiOS 6.0 and later versions, we can remove the network ports from the default hardware switch easily. Once we remove these ports, they become Interface mode where we can have different settings separately.
To do that, right-click (or double click) the hardware switch and remove the ports you want to make in interface mode.
There should be a minimum 1 port part of the hardware switch. We can’t remove all ports. Also, in this way, you can’t delete the entire hardware switch.
If you need to delete the entire hardware switch and make all ports to interface mode, then we need to follow the below steps.
Basically 3 steps involved in this process.
1) Complete the prerequisites
2) Change the mode from Switch mode to interface mode
3) Configure the network and allow access to a particular network port.
1) Prerequisites to change the mode
By default, a brand new Fortigate Firewall comes with the switch-mode enabled, default policy to allow Internet access, and DHCP to provide an IP addressed. Even if you do a factory reset of an old device, you will find these settings.
You must disable DHCP service on the FortiGate device and remove any policies related to the hardware switch interface.
Here is a Fortigate device 80C which is in switch mode. All interfaces are combined together as a single ‘internal’ interface. In this case, we can’t have different settings (IPs, policies, etc) for every LAN port in this device.
a) To remove DHCP, double click on the ‘internal’ and press edit. Deselect the checkbox of the DHCP server as shown below.
In FortiOS 6.x, it may look like below.
Press Apply or Save.
b) Remove any policies which are related to ‘internal’ port (or the hardware switch), normally you will find only one policy.
Now we are ready to change the mode.
Once you removed the policy, you will get the option to delete the default hardware switch as shown below on FortiOS 6.x. Deleting it will make all ports to Interface mode.
2) Changing from Switch mode to interface mode (in CLI)
In the older version of FortiOS and even if you want to do it by CLI/Telnet on the latest version, here are the steps.
Use a serial cable and any telnet client software for this purpose. If you like to use a built-in telnet client of Windows 8 or 8.1, check this guide.
Login with default credentials which username is admin and no password.
Type following command,
config system global set internal-switch-mode interface end
Once the device is rebooted, it will not have any network settings. Therefore, we must configure an IP address and allow access (http or https) to a particular network port that can be accessed through a network cable and internet browser later.
Interface Mode in Fortigate FortiOS 5 and 5.2 in GUI/Web
Once you have completed prerequisites to change the mode, you can go to System->Network->Interfaces, then Right Click on the Internal Interface to change mode. The option will be disabled if you have some policies and DHCP servers related to it.
Even after you changed the mode from switch to interface mode through CLI or GUI web interface and the device rebooted, you need to configure the next step by command-line interface only. Follow the below step 3 to assign IP and allow specific access.
3) Configure the network and allow access to a network port
Earlier we have changed switch port to interface mode. Now the device will have n number of individual network ports that can have individual settings and policies. After changing the mode, these ports will not have any settings, even no default IP address. Use the same CLI to configure IP and allow http or https access to a particular network port so that it can be accessed via the network with a browser.
To configure the access, (below example shows how to allow access of https and http on a particular port)
config system interface edit <interface_name> set allowaccess http https end
Note: The latest models have a separate network management port to access the device. This port usually not part of the hardware switch. You do not need to worry about assigning IP and allowing access through Telnet if you have the access to Fortigate device via the Management port.
By the above steps, you should be able to change your Fortigate device from switch mode to interface mode in FortiOS 5.x and 6..x with CLI and GUI. This will enable you to have separate settings and configurations for every network port.