When the MAC address of a device is placed in quarantine on FortiSwitch, what happens to its egress traffic?

When a device's MAC address is quarantined on a FortiSwitch, the switch isolates the device by directing all its traffic to a specially designated quarantine VLAN. This VLAN effectively becomes the new access VLAN for the quarantined device's traffic. This action is a core part of Fortinet's Security Fabric automation, allowing for the isolation of potentially compromised endpoints from the production network while potentially granting them limited access to remediation services within the quarantine segment.

B. The native VLAN is specifically for handling untagged traffic on an 802.1Q trunk port, not for isolating a specific quarantined device.

C. The switch receives untagged traffic from the endpoint, but its action is to tag and assign this traffic to the specific quarantine VLAN.

D. This term is too general. "Allowed VLAN" typically refers to the list of VLANs permitted on a trunk port, not the specific isolation VLAN used for quarantine.

1. FortiSwitch™ Managed by FortiGate 7.6.0 Administration Guide, Page 110, Section: "Quarantine".

The document states: "When a host is quarantined, the MAC address of the host is moved to the quarantine VLAN. The quarantine VLAN is a special VLAN that you create to isolate compromised or unknown devices from the rest of the network." This confirms the traffic is moved to a specific VLAN, which functions as an access VLAN for the device.

2. FortiSwitch™ Manager 7.6.0 Administration Guide, Page 101, Section: "Configuring security policies".

This guide corroborates the mechanism: "When a host is quarantined, the MAC address of the host is moved to the quarantine VLAN." This reassignment to a single, specific VLAN is functionally equivalent to placing the device's traffic into an access VLAN.