Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rjsz
New Contributor

I can't put ACLs on a new pair of Fortigate 600D

Hi,

 

I'm quite new to Fortigate and I'm trying to out some ACLs on a HA (active/passive) pair of 600D. Going through the cookbook it seems pretty simply but I am missing the Policy & Objects > IPv4 Access Control Lists menu in the GUI, and I cannot use the config firewall acl command from the CLI. There is no such command. Is there a particular licence I need to activate to gain ACL functionality on the 600D?

 

Thanks,

 

7 REPLIES 7
emnoc
Esteemed Contributor III

Let clear up lingo

 

1:A firewall ( FGT ) uses policies

 

2: you have a host of policies type ( regular , local ,ipv6 aka policy6, policy64 , policy46, interface-policy )

 

So sorry my friend a  "ACL" is not one of them ;)

 

here's a few policy types

 

 

regular ipv4 ipsec-tunnel

 

    edit 48         set srcintf "NEXOS"         set dstintf "wan1"         set srcaddr "all"         set dstaddr "all"         set action ipsec         set schedule "always"         set service "ALL"         set inbound enable         set vpntunnel "dialup_p1"     next

 

 

here's a local-in

 

 

config firewall local-in-policy     edit 12         set intf "port1"         set srcaddr "all"         set dstaddr "all"         set action accept         set service "SSH" "PING"         set schedule ''         set auto-asic-offload enable         set status enable     next

 

 

local-interface

 

config firewall interface-policy     edit 1         set status enable         set logtraffic utm         set interface ''LANINTUK"         set webfilter-profile-status enable     next end

 

 

Typically most policies are ipv4 or ipv6 related.

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
JoeAndrews

Hi - I have the same core issue, FG500D version 5.4.5, which is to say that I am missing the Policy & Objects > IPv4 Access Control Lists menu in the GUI and the CLI does not permit the config firewall acl command. I suspect that it may be a function of 'Feature Select' to enable this functionality, but I'm not sure what feature specially that would would be. All of the documentation about ACLs seems to reference that CLI command or that GUI location and neither is available. Thank you.

rwpatterson
Valued Contributor III

As Emnoc stated, the phrase "ACL" does not exist on a Fortigate. Policy is what is used to control access between points here.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
JoeAndrews

OK - just to clarify, all of the documentation that refers to ACLs, e.g., http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Policies/IPv4%... and http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/FeatureCatalog-firewall.... to list a few, is invalid? There is no CLI option or GUI menu as described in those documents?

tanr
Valued Contributor II

Interesting, I hadn't seen these before.  I do have the CLI option "config firewall acl" on 5.6.6 on a 100D.  I don't see a GUI for it.

 

Note that per the docs these only allow DENY of the listed interface/address/service, and don't provide negate options (like srcaddr-negate) so you can't use them to easily allow only a few IPs.

 

It seems like you can do this more visibly in the regular security policies in the GUI with DENY policies.

So, the main benefit of using the ACLs would be to get a little better performance.

 

If you're not seeing the option in the CLI it may be that you don't have the required NP6 processor enabled, or have hit one of the other limitations listed per http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Network%20Defense/Access%...

 

 

 

rwpatterson
Valued Contributor III

I stand corrected. I have never seen those before.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Bentonville-Schools

for future Googlers: the feature to enable it in the GUI is called "DoS Policy"

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors