IPv4/IPv6 access control lists

An access control list (ACL) is a granular, targeted blocklist that is used to block IPv4 and IPv6 packets on a specified interface based on the criteria configured in the ACL policy.

On FortiGate models with ports that are connected through an internal switch fabric with TCAM capabilities, ACL processing is offloaded to the switch fabric and does not use CPU resources. VLAN interfaces that are based on physical switch fabric interfaces are also supported. Interfaces that are connected through an internal switch fabric usually have names prefixed with port or lan, such as port1 or lan2; other interfaces are not supported.

The packets will be processed by the CPU when offloading is disabled or not possible, such as when a port on a supported model does not connect to the internal fabric switch.

ACL is supported on the following FortiGate models:

• 100D, 100E, 100EF, 101E

• 140D, 140D-POE, 140E, 140E-POE

• 1200D, 1500D, 1500DT

• 3000D, 3100D, 3200D, 3700D, 3800D, 3810D, 3815D

• All 300E and larger E-series models

• All 100F and larger F-series models

Example

To block all IPv4 and IPv6 Telnet traffic from port2 to Company_Servers:

config firewall acl
    edit 1
       set interface "port2"
       set srcaddr "all"
       set dstaddr "Company_Servers"
       set service "TELNET"
    next
end
config firewall acl6
    edit 1
        set interface "port2"
        set srcaddr "all"
        set dstaddr "Company_Servers_v6"
        set service "TELNET"
    next
end

Diagnose commands

To check the number of packets drop by an ACL:

# diagnose firewall acl counter 
ACL id 1 dropped 0 packets 

# diagnose firewall acl counter6
ACL id 2 dropped 0 packets

To clear the packet drop counter:

# diagnose firewall acl clearcounter

# diagnose firewall acl clearcounter6