How does FortiSwitch perform actions on ingress and egress traffic using the access control list (ACL)?

FortiSwitch Access Control Lists (ACLs) operate on a sequential, top-down logic. When a packet enters or exits an interface with an applied ACL, the FortiSwitch unit evaluates the policies within that list in their configured order, starting from the top. The first policy that matches the packet's characteristics (based on the defined classifiers) is applied, and the FortiSwitch immediately stops further processing of the ACL for that packet. This "first-match" principle is fundamental to how FortiSwitch enforces traffic control using ACLs, ensuring predictable and efficient policy application.

A. Only high-end FortiSwitch models support ACL.

This is incorrect. ACL is a fundamental security feature available across a broad range of FortiSwitch models, not exclusively on high-end series.

B. ACL can be used only at the prelookup stage in the traffic processing pipeline.

This is incorrect. FortiSwitch supports applying ACLs at both the pre-lookup and post-lookup stages in the traffic-processing pipeline, offering flexibility in policy enforcement.

C. Classifiers enable matching traffic based only on the VLAN ID.

This is incorrect. ACL classifiers are versatile and can match traffic based on multiple criteria, including Layer 2 (MAC addresses), Layer 3 (IP addresses), and Layer 4 (TCP/UDP ports), in addition to the VLAN ID.

---

1. Fortinet | FortiSwitchOS 7.6.0 Administration Guide, Page 131, "Access Control Lists (ACLs)" section.

The document states: "The FortiSwitch unit checks ACL policies from top to bottom. The first policy that matches the packet is applied, and the FortiSwitch unit stops checking policies." This directly supports the correct answer (D).

2. Fortinet | FortiSwitchOS 7.6.0 Administration Guide, Page 131, "Pre-lookup and post-lookup ACLs" section.

The guide explains: "You can apply an ACL at the pre-lookup stage or the post-lookup stage in the traffic-processing pipeline." This directly refutes option (B).

3. Fortinet | FortiSwitchOS 7.6.0 Administration Guide, Page 132, "Classifiers" section.

This section details the various matching criteria for classifiers, including src-mac, dst-mac, vlan, src-ip, dst-ip, protocol, src-l4port, and dst-l4port. This demonstrates that matching is not limited to only the VLAN ID, refuting option (C).

4. Fortinet | FortiSwitchOS 7.6.0 Administration Guide, Page 131, "Access Control Lists (ACLs)" section.

The general availability of the feature described in this chapter, without specific model limitations, implies it is not restricted to high-end models, making option (A) incorrect. The feature is a core part of the FortiSwitchOS.