Using FortiDDoS ACLs

You can configure access control lists (ACLs) to deny known attacks and unwarranted traffic. For example, in a data center environment, you can use ACLs to protect the router from getting overloaded by floods from known attacks.

The ACLs are part of the core hardware architecture, so they do not add to latency through the device when you enable or disable them.

FortiDDoS enforces a Global ACL that applies to all traffic, and SPP ACLs that are applied after traffic has been sorted into an SPP.

The Global ACL features include:

• An anti-spoofing ACL based on the local address configuration
• An ACL based on source IP address
• An ACL based on Geolocation addresses
• An ACL based on the IP Reputation list provided through FortiGuard

It is possible for traffic to be denied based on multiple Global ACL rules, but only one deny reason-code is logged. The reason-code is based on the following order of precedence.

1. Anti-spoofing
2. Source IP address
3. GeoLocation
4. IP Reputation

You can configure additional ACLs per SPP. The SPP ACL rules can be based on source IP address, service, or Layer 7 parameter.

The following table summarizes the traffic parameters you can use to enforce an ACL.