Fortinet Document Library

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Download PDF
Copy Link

ACL

You can use access control lists (ACLs) to configure policies for three different stages in the pipeline:

  • Ingress stage for incoming traffic
  • Prelookup stage for processing traffic
  • Egress stage for outgoing traffic

This section covers the following topics:

NOTES
  • Before FortiSwitchOS 6.0.0, you used the config switch acl policy command to configure ACL policies only for the ingress stage. In FortiSwitchOS 6.0.0 and later, the config switch acl command has changed to specify which stage is being configured. Starting in FortiSwitchOS 6.2.0, you can create groups for multiple ingress ACLs.
  • The FS-1024D and FS-524D-FPOE models do not support all action options on the ingress policy.
  • There are some limitations for ACL configuration on the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE models:
    • The layer-4 port range is limited and might not be available in FortiSwitchOS 6.4.0.
    • For the FS-108E, FS-108E-FPOE, FS-108E-POE, FS-124E, FS-124E-FPOE, and FS-124E-POE models, 256 counters are supported for the ingress stage.
    • For the FS-448E, FS-448E-FPOE, and FS-448E-POE models, 504 counters are supported only for the prelookup stage.
    • If a classifier was created with only layer-2 fields, layer-3 fields cannot be added later. If a classifier was created with only layer-3 fields, layer-2 fields cannot be added later.
    • You cannot use both drop and redirect actions in the same ACL policy.
    • ACL configuration is not supported in FortiLink mode.
    • Only the ingress policy can be configured.
  • The set redirect command works differently for the following switch models:
    • For the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE models, the egress VLAN membership is not necessary.
    • For the FS-148F, FS-148F-POE, FS-148F-FPOE, FS-124F, FS-124F-POE, and FS-124F-FPOE models, the egress VLAN membership is necessary.

ACL

You can use access control lists (ACLs) to configure policies for three different stages in the pipeline:

  • Ingress stage for incoming traffic
  • Prelookup stage for processing traffic
  • Egress stage for outgoing traffic

This section covers the following topics:

NOTES
  • Before FortiSwitchOS 6.0.0, you used the config switch acl policy command to configure ACL policies only for the ingress stage. In FortiSwitchOS 6.0.0 and later, the config switch acl command has changed to specify which stage is being configured. Starting in FortiSwitchOS 6.2.0, you can create groups for multiple ingress ACLs.
  • The FS-1024D and FS-524D-FPOE models do not support all action options on the ingress policy.
  • There are some limitations for ACL configuration on the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE models:
    • The layer-4 port range is limited and might not be available in FortiSwitchOS 6.4.0.
    • For the FS-108E, FS-108E-FPOE, FS-108E-POE, FS-124E, FS-124E-FPOE, and FS-124E-POE models, 256 counters are supported for the ingress stage.
    • For the FS-448E, FS-448E-FPOE, and FS-448E-POE models, 504 counters are supported only for the prelookup stage.
    • If a classifier was created with only layer-2 fields, layer-3 fields cannot be added later. If a classifier was created with only layer-3 fields, layer-2 fields cannot be added later.
    • You cannot use both drop and redirect actions in the same ACL policy.
    • ACL configuration is not supported in FortiLink mode.
    • Only the ingress policy can be configured.
  • The set redirect command works differently for the following switch models:
    • For the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE models, the egress VLAN membership is not necessary.
    • For the FS-148F, FS-148F-POE, FS-148F-FPOE, FS-124F, FS-124F-POE, and FS-124F-FPOE models, the egress VLAN membership is necessary.