Description
This article describes how to configure an access list on FortiGate.
Scope
FortiGate:
- 100D, 100E, 100EF, 101E, 140D, 140D-POE, 140E, 140E-POE, 1500D, 1500DT, 3000D, 3100D, 3200D, 3700D, 3800D.
- All 300E and larger E-series models.
- All 100F and larger F-series models.
Solution
Sometimes the access list is used to block the incoming traffic from different IP addresses based on the FortiGuard IP Geolocation database, this service allows Fortinet devices to query the cloud-based FortiGuard servers for the location of public IP addresses.
It is possible to configure an access list to use as a source IP object which is from type 'Geography', for the example we have a country Finland :
config firewall address
edit "Finland_addresses"
set uuid 1fe3d272-2534-51ee-ddb1-10d3c8fdd4d0
set type geography
set comment ''
set associated-interface ''
set color 0
set fabric-object disable
set country "FI"
next
end
To block the incoming traffic from IP addresses located in Finland our ACL will look like :
config firewall acl
edit 1
set status enable
set name "block_ACL"
set comments ''
set interface "wan1"
set srcaddr "Finland_addresses" -
set dstaddr "all"
set service "ALL"
next
end
It is mandatory to note that, if traffic is generated from the LAN to the IP address located in Finland, the return traffic will be blocked by the ACL, because ACL works like a normal stateless 'access-list'. The 'access-list' does not track if the packet is SYN or SYN/ACK.
For example, if your host located behind the FW initiates a SYN packet to web server in Finland, the server will respond with SYN/ACK but that packet will be blocked on the firewall, if there is an ACL like the one above.
The behavior is the same even if a normal IP address configured is used on the access-list for the source address.
Enable GUI visibility:
To enable the GUI visualization of this option, it is necessary to enable the Additional Feature 'DoS Policy' under the Feature Visibility in the System configuration, as below:
Note: The ACL feature is available only on FortiGates with NP6-accelerated interfaces. ACL checking is one of the first things that happens to the packet and checking is done by the NP6 processor. The result is very efficient protection that does not use CPU or memory resources.
Note: The ACL feature is available for select FortiGate models. Check the related article for more information.
Before configuring an access list, read the following to confirm whether the device supports that feature:
