The most effective initial security measure for FortiLink is to pre-authorize the switch by its serial number in the FortiGate’s allowed devices list. This ensures only a specific, known switch can join the management network, preventing unauthorized switches from connecting, even if they have the correct credentials. While passwords and 802.1X add layers, the serial number whitelist is the foundational control for FortiLink security.

Broadcast Rate Limiting, configured directly within the settings of the specific VLAN interface on the FortiSwitch, is the precise tool for this task. It allows you to set a maximum kilobits-per-second rate for broadcast traffic originating within that VLAN. Storm control (option A) is a broader mechanism that typically works by percentage of bandwidth and often applies to all traffic types (broadcast, multicast, unknown-unicast), not just broadcast for a single VLAN.

FortiSwitch ports support a native VLAN (untagged) and multiple tagged VLANs. To allow a single server NIC to communicate on two VLANs, you configure the port as a hybrid/trunk port. You set the native (PVID) to the server’s primary VLAN (untagged) and add the second VLAN as a tagged member. The server must be configured with an 802.1Q tag for the secondary VLAN IP address. This is a common configuration for virtualization hosts or network management servers.

Rapid Spanning Tree Protocol (RSTP) is the recommended standard for most deployments as it provides significantly faster convergence than legacy STP and is widely supported by all vendors. Enabling Loop Protection adds an extra layer of security by detecting unidirectional links that could cause loops, which RSTP alone might not catch. MSTP is more complex and used for mapping multiple VLANs to instances, which isn’t the primary requirement here. BPDU Guard is for edge ports, not for inter-switch links.

The ‘FortiAP Auto-Discovery’ feature is specifically designed for this purpose. When enabled on a switch port, it uses LLDP to detect a connected FortiAP. It then automatically applies the settings (like VLANs, PoE priority) defined in a pre-configured FortiAP Profile on the FortiGate. This allows for zero-touch deployment of access points. While LLDP-MED (A) is part of the mechanism, the specific Fortinet feature that leverages it for automated configuration is the FortiAP Auto-Discovery and profile application.

In a FortiGate-managed FortiSwitch setup, the switch operates primarily at layer 2. For a client to communicate, its connected switch port must be configured as an access port in the correct VLAN (VLAN 10) or as a trunk port with VLAN 10 tagged/native. If the port is assigned to the wrong VLAN or left in the default VLAN (1), the client’s traffic will not be forwarded to the FortiGate on the correct VLAN 10 trunk, making the gateway unreachable. This is a fundamental layer 2 configuration step.

In an 802.1X framework, the network device (the FortiSwitch) acts as the Authenticator. It controls physical access to the port, communicates with the client (Supplicant) using the EAPOL protocol, and relays authentication messages between the Supplicant and the Authentication Server (e.g., a RADIUS server like Active Directory NPS). The FortiGate, acting as the RADIUS client in this scenario, is the point where the switch (Authenticator) sends the RADIUS requests. The switch itself does not perform the authentication; it enforces the result.

High CPU on a switch is a classic symptom of a broadcast storm caused by a layer 2 switching loop. The scenario points to a restored configuration. It’s highly plausible the backup config had a specific port setup (e.g., as a trunk) that, when restored to the new switch, created a physical loop with another switch or device. This would generate a massive amount of traffic, consuming CPU and causing network-wide issues. Checking for and breaking the physical loop is the immediate first step.

Port Security with a sticky MAC address is the direct and standard method for this requirement. You bind the server’s specific MAC address to the port. Then, by setting the violation mode to ‘shutdown’, the port will be error-disabled if any other MAC address attempts to send traffic. This provides a hard enforcement at the switch port level. MAC filtering on the FortiGate (B) is a layer 3/4 control that would block traffic but not necessarily disable the port. 802.1X (C) is more complex for a single static device.

The most effective initial security measure for FortiLink is to pre-authorize the switch by its serial number in the FortiGate’s allowed devices list. This ensures only a specific, known switch can join the management network, preventing unauthorized switches from connecting, even if they have the correct credentials. While passwords and 802.1X add layers, the serial number whitelist is the foundational control for FortiLink security.0