FortiTelemetry is a critical part of Security Fabric communications and requires explicit
configuration for each participating FortiGate interface. The administrative access setting
"fabric" (corresponding to FortiTelemetry) must be manually enabled per interface on both
upstream and downstream devices. This is performed in the GUI under Administrative
Access or via the CLI using the command set allowaccess fabric for the relevant network
interface. Without this step, FortiTelemetry communications will not occur on that interface.
Additionally, the default communication between downstream and upstream FortiGate units
in the Security Fabric is over TCP port 8013. This port is well-documented as the standard
for Security Fabric and FortiTelemetry connections, and must be open and permitted across
the network path for connectivity and status enforcement between units. The downstream
FortiGate initiates the connection to the upstream via this port unless otherwise configured.
This has also been documented as a PCI-relevant port, showing its default usage.
Other options:
Neighbor Discovery in FortiOS uses IPv6 ND protocol, not TCP.
FortiTelemetry port (8013) can be modified, but the interface Administrative Access for the
Security Fabric must be manually enabled; Neighbor Discovery port modification is not
documented as a supported change for FortiGate.
Reference:
FortiGate/FortiOS Administration Guide: Enabling FortiTelemetry (fabric) on interfaces
Fortinet Technical Tip: FortiTelemetry uses TCP port 8013 by default
PCI compliance documentation on port 8013 usage for Security Fabric
Fortinet Security Fabric setup procedures and interface options
