FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
sgiannogloudis
Article Id 220188
Description This article describes the functions of port groups in high end platforms.
Scope FortiGate v6.4, v7.0, and v7.2 GA releases.
Solution

In top-end FortiGates for example 2600F, 3400E, and 3600E the majority of the physical interfaces are participating in port groups.

 

Port group can be easily noticed, over the physical interface itself under the GUI's Network -> Interfaces section:

 

sgiannogloudis_0-1659941819730.png

 

The above example is from a FortiGate-3600E and it is easily possible to observe that port3 up to port6 belongs to the same group.

 

A group consists of 4 ports and the settings like interface speed, media type and Forward Error Correction [FEC] are the same for all group interface members by default.

 

When the user changes one of the speed settings, FortiOS generates a warning message and changes the setting in order to be identical in the other 3 port group members as well.

 

For example, speed settings was changed only in port33:

 

config system interface

    edit port33
        set speed 25000full
    next
"port33-port36" speed and/or mediatype/FEC will be changed to 25000full due to hardware limit. 
Do you want to continue? (y/n)y

 

Then, all the other ports three ports in the same group were automatically configured with the same setting:

 

show system interface

    edit "port34"
        set vdom "root"
        set type physical
        set speed 25000full
    next
        edit "port35"
             set vdom "root"
             set type physical
             set speed 25000full
         next
             edit "port36"
                 set vdom "root"
                 set type physical
                   set speed 25000full
             next

 

It will not be possible to remove or split the ports separately from the port group members as it comes by design.

 

Note:

A port group will have the same speed across all its interfaces, due to hardware limitations.

 

If one interface is not part of an aggregate, It is allowed to change its speed, as long as it's possible to change the speed of all other interfaces of the port group.

 

As explained, FortiOS does not allow to change in the speed of an interface that is a member of an aggregate, so if other ports of the same port group are members of an aggregate, it will not be possible to change the speed of a physical interface that is not part of an aggregate. 

 

Changing the 'mediatype' option will not be forced on the rest of the group members.