An access control list (ACL) is a granular, targeted blocklist that is used to block IPv4 and IPv6 packets on a specified interface based on the criteria configured in the ACL policy.
On FortiGate models with ports that are connected through an internal switch fabric with TCAM capabilities, ACL processing is offloaded to the switch fabric and does not use CPU resources. VLAN interfaces that are based on physical switch fabric interfaces are also supported. Interfaces that are connected through an internal switch fabric usually have names prefixed with port or lan, such as port1 or lan2; other interfaces are not supported.
The packets will be processed by the CPU when offloading is disabled or not possible, such as when a port on a supported model does not connect to the internal fabric switch.
ACL is supported on the following FortiGate models:
- 100D, 100E, 100EF, 101E
- 140D, 140D-POE, 140E, 140E-POE
- 1200D, 1500D, 1500DT
- 3000D, 3100D, 3200D, 3700D, 3800D, 3810D, 3815D
- All 300E and larger E-series models
- All 100F and larger F-series models
config firewall acl edit 1 set interface "port2" set srcaddr "all" set dstaddr "Company_Servers" set service "TELNET" next end config firewall acl6 edit 1 set interface "port2" set srcaddr "all" set dstaddr "Company_Servers_v6" set service "TELNET" next end
# diagnose firewall acl counter ACL id 1 dropped 0 packets
# diagnose firewall acl counter6 ACL id 2 dropped 0 packets
# diagnose firewall acl clearcounter
# diagnose firewall acl clearcounter6