Support user-configurable ACL
You can now use an access control list (ACL) to configure a policy for the ingress stage of the pipeline for incoming traffic. After creating an ACL group for the ingress policy, you apply the ACL group to a managed switch port.
|
A user-configurable ACL might conflict with or be overridden by an ACL implemented by other managed FortiSwitch features. If a user-configurable ACL and an internal ACL do not conflict, the resulting behavior depends on the FortiSwitch model. Fortinet recommends validating user-configurable ACLs to make certain that they operate correctly with other enabled features. |
To use an ACL:
-
Create an ACL group and add the ingress policy to it.
Create an ACL ingress policy
The ACL ingress policy includes the following key attributes:
-
Interface—The port on which traffic arrives at the switch. The policy applies to ingress traffic only (not egress traffic).
-
Classifier—The classifier identifies the packets that the policy will act on. Each packet can be classified based on one or more criteria. The supported criteria are source and destination MAC address, VLAN identifier, and source and destination IP address.
-
Actions—If a packet matches the classifier criteria for a given ACL, the following types of action can be applied to the packet:
- Allow or block the packet
- Count the number of ingress packets
The switch uses specialized TCAM memory to perform ACL matching.
|
|
The order of the classifiers provided during group creation (or during an ACL update in a group when new classifiers are added ) matter. Hardware resources are allocated as best fit at the time of creation, which can cause some fragmentation and segmentation of hardware resources because not all classifiers are available at all times. Because the availability of classifiers is order dependent, some allocations succeed or fail at different times. |
To create an ACL ingress policy in the CLI:
config switch-controller acl ingress
edit <policy_identifier>
config action
set count {enable | disable}
set drop {enable | disable}
end
config classifier
set dst-ip-prefix <IPv4_address> <netmask>
set dst-mac <destination_MAC_address>
set src-ip-prefix <IPv4_address> <netmask>
set src-mac <source_MAC_address>
set vlan <1-4094>
end
next
end
Create an ACL group
An ACL group contains one or more ACLs.
|
|
The ACL ingress policies are assigned to ACL group 3 in the managed FortiSwitch unit. If the managed FortiSwitch unit does not support ACL group 3, the user-configurable ACL is not supported. |
To create an ACL group in the CLI:
config switch-controller acl group
edit "<ACL_group_name>"
set ingress <policy_identifier1> <policy_identifier2> ...
next
end
For example:
config switch-controller acl group
edit "ACLgroup1"
set ingress 2 3 4
next
end
Apply the ACL group to a managed switch port
You can apply one or more ACL groups to a managed switch port.
To apply an ACL group to a managed switch port in the CLI:
config switch-controller managed-switch
edit <FortiSwitch_serial_number>
config ports
edit <managed_switch_port_name>
set acl-group "<ACL_group_name1> <ACL_group_name2> ..."
next
end
next
end
For example:
config switch-controller managed-switch
edit FS1D243Z14000016
config ports
edit port10
set acl-group "ACLgroup1 ACLgroup2 ACLgroup3"
next
end
next
end
View the counters
|
|
On the 4xxE, 1xxE, and 1xxF platforms, the ACL byte counters are not available (they will always show as 0 on the CLI). The packet counters are available. |
You can use the CLI to view the counters associated with the ingress policies.
To view the counters in the CLI:
diagnose switch-controller switch-info acl-counters <FortiSwitch_serial_number>
For example:
diagnose switch-controller switch-info acl-counters FS1D243Z14000016
Configuration example
In the following example, the ingress ACL policy prevents a PC connected to S248EPTF18001384 (which is managed by a FortiGate device) from accessing 8.8.8.8 255.255.255.255.
config switch-controller acl ingress
edit 1
config action
set drop enable
end
config classifier
set dst-ip-prefix 8.8.8.8 255.255.255.255
set src-mac 00:0c:29:d4:4f:3c
end
next
end
config switch-controller acl group
edit "group1"
set ingress 1
next
end
config switch-controller managed-switch
edit "S248EPTF18001384"
config ports
edit "port6"
set acl-group "group1"
next
end
next
end