While FortiSwitch can collect all the listed LLDP-MED TLVs (Network Policy, Power Management, Location, and Inventory Management), the primary focus for tracking and identifying network devices is on the Inventory Management TLV.

This TLV carries critical details such as:

Manufacturer

Model

Hardware/Firmware versions

Serial/Asset numbers

This information provides a granular understanding of the devices on your network.

The output of the diagnose switch physical-ports summary command provides critical insight into how a FortiSwitch is being managed by examining VLAN assignments , tag protocol identifiers (TPID) , and internal port behavior . In the provided exhibit, several ports—including port1 , port5 , and the internal port—are assigned to VLAN 4094 .

According to the FortiSwitchOS 7.6 Administrator Guide, VLAN 4094 is reserved for FortiLink management traffic when a FortiSwitch is managed by a FortiGate. FortiLink uses this dedicated VLAN to carry control-plane traffic such as configuration synchronization, monitoring data, LLDP-based discovery, and keepalive messages between the FortiGate and FortiSwitch. The presence of VLAN 4094 on physical interfaces is a strong and explicit indicator of FortiGate-managed mode .

In standalone or local management mode, FortiSwitch ports typically default to VLAN 1 or administrator-defined VLANs, and VLAN 4094 is not automatically assigned . Similarly, FortiSwitch Cloud–managed devices do not use VLAN 4094 in this manner, as cloud management relies on IP connectivity to FortiEdge Cloud rather than FortiLink encapsulation.

Additionally, the internal port showing VLAN 4094 further confirms FortiLink operation, as this internal interface is used by the switch ASIC to communicate with the FortiGate over the FortiLink tunnel. This behavior is documented in FortiOS 7.6 and FortiSwitchOS 7.6 design guides as characteristic of FortiGate-managed FortiSwitch deployments.

Therefore, based on the VLAN assignments shown—specifically the use of VLAN 4094 —the most accurate and fully verified conclusion is that the FortiSwitch is managed by FortiGate , making Option B the correct answer.

In a FortiGate-managed switching deployment using FortiLink , FortiSwitch devices rely on their internal interface to establish management connectivity with the FortiGate. According to the FortiSwitchOS 7.6 Administrator Guide, when a FortiSwitch operates in FortiLink mode, the internal interface must obtain an IP address dynamically via DHCP from the FortiGate over the FortiLink interface. This IP address is required for control-plane communication, including CAPWAP-based management messaging.

From the exhibit, FortiGate successfully manages Core-1 and Core-2 , while Access-1 remains offline. The FortiGate diagnostic output explicitly reports that it cannot detect Access-1 at the FortiLink interface , even though CAPWAP is enabled and the switch is in FortiLink mode. This eliminates CAPWAP configuration (Option B) as the root cause.

Examining the FortiSwitch Access-1 CLI output reveals the key issue:

The internal interface is configured with mode: static and an IP address of 0.0.0.0 .

This configuration prevents Access-1 from obtaining a valid FortiLink management IP address, which is mandatory for FortiGate discovery and authorization. In contrast, FortiSwitch devices managed by FortiGate must have their internal interface set to DHCP , allowing the FortiGate to automatically assign an address from the FortiLink subnet.

Assigning a static IP (Option A) is not recommended or required in FortiLink-managed mode, NTP configuration (Option D) has no impact on discovery, and CAPWAP is already enabled as shown in the FortiGate output.

Therefore, the initial and required corrective action is to set the Access-1 internal interface mode to DHCP , making Option C the correct and fully verified answer based on FortiOS 7.6 and FortiSwitchOS 7.6 documentation.

According to the FortiSwitchOS 7.6 Administration Guide and the FortiSwitch 7.6 Study Guide , Link Layer Discovery Protocol-Media Endpoint Discovery (LLDP-MED) is an enhancement to standard LLDP that provides advanced discovery and configuration for endpoints li 1 ke IP phones. While the current configuration in the exhibit correctly handles Network Policy TLVs to advertise QoS 2 and VLAN settings to the phones, it is missing the specific component required for data collection. 34

To coll 5 ect detail 6 ed information such as the manufacturer, software version, hardware version, and serial or asset numbers , you must Enable LLDP-MED inventory management TLVs (Option C) . The documentation specifies that when the inventory-management TLV is active, the switch can retrieve these extensive device characteristics from the connected Media Endpoints. This information is then visible to the administrator through the FortiGate or FortiSwitch monitoring tools, providing a complete hardware inventory of the voice network.

Regarding the other options: Option A is unnecessary because a single LLDP profile can support multiple TLV types simultaneously by adding them to the med-tlvs string. Option B is already partially implemented in the exhibit's network policy but does not contribute to device detection or data collection. Option D is used for automatic trunking between FortiSwitches and is unrelated to endpoint device information. Therefore, the addition of the inventory-management TLV is the specific requirement to fulfill the goal of collecting detailed IP phone data.

According to the FortiSwitchOS 7.6 Administration Guide and the FortiSwitch 7.6 Study Guide , Dynamic ARP Inspection (DAI) is a security feature used to intercept, log, and discard ARP packets with invalid IP-to-MAC address bindings. DAI is primarily used to prevent "Man-in-the-Middle" attacks, such as ARP spoofing or ARP cache poisoning.

In this scenario, DAI is active on VLAN 10. When DAI is enabled, the FortiSwitch intercepts all ARP packets on untrusted ports and validates them against a trusted source—most commonly the DHCP snooping database . As shown in the "DHCP Snooping database" exhibit, PC2 is correctly mapped to IP 10.0.10.30 and MAC 00:09:0F:AB:00:0B.

When PC2 attempts to send a forged ARP reply claiming that IP 10.0.10.254 (the FortiGate's IP) is located at its own MAC address (00:09:0F:AB:00:0B), the FortiSwitch's DAI engine inspects the packet. It checks the DHCP snooping database for a binding that matches IP 10.0.10.254 to MAC 00:09:0F:AB:00:0B. Finding no such valid entry (because the database correctly identifies the MAC 00:09:0F:AB:00:0B as belonging to IP 10.0.10.30), the switch identifies the ARP packet as illegitimate.

Consequently, the FortiSwitch will drop the ARP replies because they fail the DAI validation check against the established DHCP snooping bindings. Option A is incorrect as DAI functions independently of IPSG once the database is populated. Option B is incorrect because "accepting" the spoofed packet is the opposite of DAI's purpose. Option C is incorrect because DAI is specifically designed to run on untrusted ports to protect the network from client-side attacks.

To enable access to the FortiSwitch management interface from the network, certain configuration adjustments need to be made, particularly considering the VLAN settings displayed in the exhibit:

Adding port24 native VLAN to the allowed VLANs on internal (Option A) : The management VLAN (VLAN 4094 in this case, as it is set as the native VLAN on the 'internal' interface of the FortiSwitch) must be included in the allowed VLANs on the interface that provides management connectivity. Since port24 is set with a different native VLAN (VLAN 100), VLAN 4094 (the management VLAN) should be allowed through to ensure connectivity.

Allow VLAN ID 4094 on port24 if management traffic is tagged (Option C) : Management traffic is tagged on VLAN 4094. Since port24 is connected to the network and serves as an uplink, allowing VLAN 4094 ensures that management traffic can reach the management interface of the FortiSwitch through this port.

The changes align with Fortinet’s best practices for setting up management VLANs and ensuring they are permitted on the relevant switch ports for proper management traffic flow.

In FortiSwitchOS 7.6, achieving link-level redundancy and active-active uplink utilization across two separate FortiSwitch units requires a technology that operates independently of Spanning Tree Protocol (STP). This requirement is fulfilled by Multichassis Link Aggregation Group (MCLAG) .

MCLAG allows two FortiSwitch devices to operate as a logical aggregation peer , presenting themselves as a single logical switch to an upstream device such as a FortiGate. With MCLAG, FortiGate can form a single LACP-based aggregated interface that spans both FortiSwitches. This enables simultaneous use of uplinks on both switches , providing full bandwidth utilization and redundancy without blocking links, which is a fundamental limitation of STP-based designs.

According to the FortiSwitchOS 7.6 Administrator Guide, MCLAG synchronizes control-plane information between the two FortiSwitch peers using inter-switch links (ISLs) and dedicated keepalive mechanisms. This ensures consistent forwarding behavior and loop-free topology while allowing all member links to remain active. If one FortiSwitch fails, traffic continues to flow through the remaining switch with minimal disruption.

The other options do not meet the stated requirement. A standard LAG (Option D) operates only within a single switch and cannot span multiple FortiSwitch units. Multi-tier topology (Option A) and full mesh HA (Option C) describe architectural layouts or FortiGate HA concepts but do not provide link-level aggregation across switches.

Therefore, the only configuration that allows FortiGate to use uplinks on both FortiSwitches simultaneously without relying on STP is Multichassis Link Aggregation Group (MCLAG) , making Option B the correct and fully verified answer.

According to the FortiSwitchOS 7.6 Administration Guide and the FortiSwitch 7.6 Study Guide , the way a FortiSwitch handles VLAN tags on egress (outgoing) traffic is governed by the port's Native VLAN and its Untagged VLAN list . When traffic for VLAN 10 arrives at port2 (the uplink) and is forwarded to port1, the switch must determine whether to strip the 802.1Q tag before transmission.

Untagged VLAN List (Option B): The documentation explicitly states that the "untagged VLAN list" specifies VLANs for which the port will transmit frames without the VLAN tag . By adding VLAN ID 10 to the untagged VLANs on port1, any traffic belonging to VLAN 10 will have its tag stripped at the egress point, ensuring PC1 receives a standard untagged frame.

Configuration Logic (Option C): In FortiSwitch management, moving a VLAN from the "Allowed" list (which typically implies tagged delivery) to the "Untagged" list on a specific interface forces the switch to perform the tag-stripping action. This effectively converts the port from a trunked behavior for that VLAN to an "access" or untagged behavior.

Regarding the incorrect options: Option A (MAC-based assignment) is used primarily for ingress classification . While it can assign a device to a VLAN when it sends traffic into the switch, the documentation notes that by default, egress packets for MAC-based VLANs still include the tag unless the untagged list is configured. Option D (Private VLANs) is a security feature for isolating traffic between ports within the same VLAN and does not address the physical tagging requirements of the endpoint.

In mixed-vendor network environments, such as deployments that include both FortiSwitch and Cisco devices, proper Layer 2 discovery protocols must be enabled to allow devices to automatically discover neighbors and exchange essential device and interface information. FortiSwitchOS 7.6 supports both Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) to ensure interoperability.

Cisco Discovery Protocol (CDP) is a Cisco-proprietary Layer 2 discovery protocol widely used by Cisco switches, routers, and IP phones. When CDP is enabled on FortiSwitch interfaces, Cisco devices can discover FortiSwitch neighbors and receive information such as device ID, port ID, platform, and capabilities. This is particularly important in Cisco-centric networks where CDP is the primary discovery mechanism.

Link Layer Discovery Protocol (LLDP) , defined by IEEE 802.1AB, is a vendor-neutral discovery protocol supported by both Fortinet and Cisco devices. Enabling LLDP allows FortiSwitch and Cisco devices to exchange standardized information including system name, port description, VLAN information, and management address. LLDP is essential for cross-vendor compatibility and is commonly enabled by default in modern enterprise networks.

The remaining options are incorrect. Unidirectional Link Detection (UDLD) is used to detect unidirectional fiber or copper link failures and does not provide device discovery or information exchange. LLDP-MED is an extension of LLDP specifically designed for media endpoints such as IP phones and is not required for general switch-to-switch discovery.

Therefore, to ensure automatic discovery and information exchange between FortiSwitch and Cisco devices, both CDP and LLDP must be enabled , making Options B and C the correct and fully verified answers based on FortiSwitchOS 7.6 documentation.