Connectivity tests are being performed on a newly configured VLAN. The VLAN is configured on a FortiSwitch device that is managed by FortiGate. During testing, it is observed that devices within the…

Question

Options

• AAccess VLAN is enabled on the VLAN.
• BThe FortiSwitch MAC address table is missing entries.
• CThe FortiGate ARP table is missing entries.
• DThe native VLAN configured on the ports is incorrect.

• A
  83% (24)
• B
  3% (1)
• C
  10% (3)
• D
  3% (1)

Explanation

Observed behavior: Devices in the VLANcan ping FortiGate -> gateway reachability OK. FortiGatecan ping devicesin that VLAN -> return path OK. Inter-VLAN routingworks -> FortiGate's L3 and policies are fine. Devices in the same VLAN cannot ping each other -> problem is on theL2 switching plane, not On FortiSwitch (managed by FortiGate), there is a feature calledAccess VLAN(sometimes described in NAC/dynamic segmentation context): WhenAccess VLANis enabled on a VLAN, the switchdoes not perform normal L2 forwardingbetween hosts in that VLAN. Instead, all traffic from endpoints in that VLAN isforced upstream to FortiGate, as if every frame were destined for the gateway. This is used for designs where you wantall intra-VLAN traffic inspected by the firewall, implementing micro-segmentation. Resulting behavior: Host -> FortiGate: works (frames are forwarded to FortiGate). FortiGate -> Host: works (routed back). Host A -> Host B (same VLAN): Frame from A goes to FortiGate. FortiGate seessource and destination in same subnet; depending on policy, it may drop or not have a policy allowing that traffic. Even if allowed, certain designs still break pure L2 expectations. In the exam scenario, the key point is: IfAccess VLAN is enabled,local L2 communication within that VLAN is disabled, so hosts in the same VLAN cannot communicate directly. That perfectly explains: Same VLAN hosts can't ping each other But they can both reach FortiGate and beyond

No community discussion yet for this question.