ACL

You can use access control lists (ACLs) to configure policies for three different stages in the pipeline:

• Ingress stage for incoming traffic
• Prelookup stage for processing traffic
• Egress stage for outgoing traffic

This section covers the following topics:

• ACL policy attributes
• Configuring an ACL policy
• Configuration examples
• Selective packet sampling
• Creating a schedule

NOTES

• Before FortiSwitchOS 6.0.0, you used the config switch acl policy command to configure ACL policies only for the ingress stage. In FortiSwitchOS 6.0.0 and later, the config switch acl command has changed to specify which stage is being configured. Starting in FortiSwitchOS 6.2.0, you can create groups for multiple ingress ACLs.
• The FS-1024D and FS-524D-FPOE models do not support all action options on the ingress policy.
• For the FS-448E, FS-448E-FPOE, and FS-448E-POE models, 504 counters are supported only for the prelookup stage.
• ACL configuration is not supported in FortiLink mode.
• There are some limitations for ACL configuration on the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, FS-148E-POE, FS-108F, FS-108F-POE, FS-108F-FPOE, FS-124F, FS-124F-POE, FS-124F-FPOE, FS-148F, FS-148F-POE, and FS-148F-FPOE models:
  • The layer-4 port range is limited and might not be available in FortiSwitchOS 6.4.0.
  • Use the get switch acl usage command to find out how many counters are available on your switch model.
  • If a classifier was created with only layer-2 fields, layer-3 fields cannot be added later. If a classifier was created with only layer-3 fields, layer-2 fields cannot be added later.
  • You cannot use both drop and redirect actions in the same ACL policy.
  • Only the ingress policy can be configured. There are seven options (dst-ip-prefix, dst-mac, ether-type, service, src-ip-prefix, src-mac, and vlan-id) for configuring the classifier and five options (cos-queue, count, drop, outer-vlan-tag, and redirect) for configuring the action.
• The set redirect command works differently for the following switch models:
  • For the FS-108E, FS-108E-POE, FS-108E-FPOE, FS-124E, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE models, the egress VLAN membership is not necessary.
  • For the FS-148F, FS-148F-POE, FS-148F-FPOE, FS-124F, FS-124F-POE, and FS-124F-FPOE models, the egress VLAN membership is necessary.