Description
This article describes how to block TCP ports using an Access Control List (ACL) on FortiGate to mitigate DDoS attacks. It provides a step-by-step guide on configuring an ACL to block specific ports and explains the difference between using an ACL and a local-in policy.
Scope
FortiGate.
Solution
To block TCP ports using an ACL on FortiGate, follow these steps:
- Go to Config -> Firewall -> service group and create a new service group that includes the ports to be blocked.
- Go to Config -> Firewall -> ACL and create a new ACL that references the service group created in step 1.
- Configure the ACL to block traffic from all sources to the specified destination IP address and ports.
- Apply the ACL to the external interface to block the specified ports.
Note:
The FortiGate CPU handles local-in policies and does not offload them to the Network Processing Unit (NPU). However, ACLs can be offloaded to the NPU7, which can help reduce CPU usage.
