An access control list (ACL) is a granular, targeted blocklist that is used to block IPv4 and IPv6 packets on a specified interface based on the criteria configured in the ACL policy.
On FortiGate models with ports that are connected through an internal switch fabric with TCAM capabilities, ACL processing is offloaded to the switch fabric and does not use CPU resources. VLAN interfaces that are based on physical switch fabric interfaces are also supported. Interfaces that are connected through an internal switch fabric usually have names prefixed with port or lan, such as port1 or lan2; other interfaces are not supported.
The packets will be processed by the CPU when offloading is disabled or not possible, such as when a port on a supported model does not connect to the internal fabric switch.
ACL is supported on the following FortiGate models:
100D, 100E, 100EF, 101E
140D, 140D-POE, 140E, 140E-POE
1200D, 1500D, 1500DT
3000D, 3100D, 3200D, 3700D, 3800D, 3810D, 3815D
All 300E and larger E-series models
All 100F and larger F-series models
To block all IPv4 and IPv6 Telnet traffic from port2 to Company_Servers:
config firewall acl edit 1 set interface "port2" set srcaddr "all" set dstaddr "Company_Servers" set service "TELNET" next end config firewall acl6 edit 1 set interface "port2" set srcaddr "all" set dstaddr "Company_Servers_v6" set service "TELNET" next end
To check the number of packets drop by an ACL:
# diagnose firewall acl counter ACL id 1 dropped 0 packets
# diagnose firewall acl counter6 ACL id 2 dropped 0 packets
To clear the packet drop counter:
# diagnose firewall acl clearcounter
# diagnose firewall acl clearcounter6