You can use access control lists (ACLs) to configure policies for three different stages in the pipeline:
- Ingress stage for incoming traffic
- Prelookup stage for processing traffic
- Egress stage for outgoing traffic
This section covers the following topics:
- ACL policy attributes
- Configuring an ACL policy
- Configuration examples
- Selective packet sampling
- Creating a schedule
- Before FortiSwitchOS 6.0.0, you used the
config switch acl policycommand to configure ACL policies only for the ingress stage. In FortiSwitchOS 6.0.0 and later, the
config switch aclcommand has changed to specify which stage is being configured. Starting in FortiSwitchOS 6.2.0, you can create groups for multiple ingress ACLs.
- The FS-1024D and FS-524D-FPOE models do not support all action options on the ingress policy.
- For the FS-448E, FS-448E-FPOE, and FS-448E-POE models, 504 counters are supported only for the prelookup stage.
- ACL configuration is not supported in FortiLink mode.
- There are some limitations for ACL configuration on the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, FS-148E-POE, FS-108F, FS-108F-POE, FS-108F-FPOE, FS-124F, FS-124F-POE, FS-124F-FPOE, FS-148F, FS-148F-POE, and FS-148F-FPOE models:
- The layer-4 port range is limited and might not be available in FortiSwitchOS 6.4.0.
- Use the
get switch acl usagecommand to find out how many counters are available on your switch model.
- If a classifier was created with only layer-2 fields, layer-3 fields cannot be added later. If a classifier was created with only layer-3 fields, layer-2 fields cannot be added later.
- You cannot use both drop and redirect actions in the same ACL policy.
- Only the ingress policy can be configured.
set redirectcommand works differently for the following switch models:
- For the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE models, the egress VLAN membership is not necessary.
- For the FS-148F, FS-148F-POE, FS-148F-FPOE, FS-124F, FS-124F-POE, and FS-124F-FPOE models, the egress VLAN membership is necessary.