Which two statements about 802.1X authentication on FortiSwitch ports are true? (Choose two.)

FortiSwitch, when managed by FortiGate in a FortiLink configuration, uses "FortiSwitch Security Policies" to enable and configure 802.1X on switch ports. This policy is then assigned to the desired ports.

FortiSwitch supports multiple 802.1X modes. One of these is port-based authentication. In this mode, once a single device successfully authenticates on a port, the port state is set to authorized, and all traffic from any device connected to that same port (for example, through a downstream unmanaged switch) is permitted onto the network. This behavior is described in option A.

C. FortiSwitch 802.1X configurations can use external RADIUS servers for authentication. A local user database on the FortiGate is an option but is not mandatory.

D. FortiSwitch supports features like MAC Authentication Bypass (MAB) specifically for devices that do not have an 802.1X supplicant, allowing them to be authenticated based on their MAC address.

1. FortiSwitch™ Managed by FortiOS 7.6 Administration Guide, Page 111, "Configuring 802.1X port-based authentication".

Reference for B: The guide states, "You can configure 802.1X port-based authentication by creating a security policy and then applying the policy to one or more FortiSwitch ports." This directly supports option B.

Reference for A: The same section describes the behavior: "You can configure port-based network access control to block traffic from a client on a specific port until the client is authenticated. After one client is authenticated, any traffic from other clients on the same port is allowed." This confirms option A.

Reference for C: On page 112, Step 4 of the configuration process instructs to "Select one or more RADIUS servers from the User Groups list," demonstrating that external RADIUS servers are used, invalidating the claim that a local database must be used.

Reference for D: On page 112, a configuration option is "MAC authentication bypass (MAB)," which is explicitly for devices that do not support 802.1X, proving option D is false.