A small utility back-office closet has four physical FortiGate ports connected to four unmanaged switches serving printers and workstations that all belong to the same trust level, and the network team wants these four ports to behave as one interface without needing a firewall policy between them, while still preserving other physical ports for zone separation elsewhere. What should they configure?

A software switch groups multiple physical (or VLAN) interfaces into a single logical interface that behaves like an internal switch: devices on any member port can reach each other without a firewall policy, while the group still counts as one interface for addressing and for policies to the rest of the network. That collapses the four ports serving equally trusted devices into one manageable interface, while other physical ports stay untouched for separate zone use. Four separate VLAN subinterfaces would instead create four independent Layer 3 segments, each needing its own policy to reach the others — the opposite of the goal. An aggregate interface bundles ports toward a single upstream device using a link protocol like LACP; it assumes both ends negotiate a bundle, which unmanaged switches serving individual end devices don't do, and it's meant for combining bandwidth to one destination, not switching locally between four downstream device groups. Four independent firewall zones would still need explicit policies between each zone, contradicting the no-policy-needed requirement. To confirm the software switch works, verify a workstation on one member port can reach a printer on another with no matching firewall policy present.