Technical Tip: FortiGate replies to pings on down interface

There are two cases:

1. Link is down, but the port is administratively up (e.g., disconnected cable).

FortiGate will reply to a ping request.

There is an up flag:

diagnose netlink interface list

if=port3 family=00 type=1 index=9 mtu=1500 link=0 master=0
ref=14 state=start present no_carrier fw_flags=0 flags=up broadcast multicast

2. Port is administratively down (set status down).

    

In this case, FortiGate will not reply.

There is no up flag:

diagnose netlink interface list

if=port3 family=00 type=1 index=9 mtu=1500 link=0 master=0
ref=9 state=present no_carrier fw_flags=0 flags=broadcast multicast

Note: If it is required that an interface always appear as up, a loopback interface is the best option. It remains up at all times and can also be used for Layer 3 testing.