Technical Tip: Configuring MAC address filtering on a FortiGate - IP/MAC binding
Description
This article describes that in a normal operation, FortiGate firewalls offer network control, packet filtering, based on elements such as source and destination IP addresses. This is done using Firewall policies.
A FortiGate firewall can be configured to restrict access by workstation MAC address. When binding and IP address to a specific MAC address a higher level of control and reporting can be obtained. This allows for greater security as a trusted address that may have been spoofed will be verified against a MAC address to ensure permissions.
This procedure will only help when devices being restricted reside on the same network segment as a FortiGate interface. When routers are involved, source MAC addresses will be overridden and this check will no longer apply.
The following is a brief description of how this can be done.
Scope
MAC, IP Binding, Filtering.
Solution
This is only recommended in small to medium networks. Extra caution is required to implement in large networks. As mentioned earlier, if any routing takes place before sending traffic to a FortiGate the issue of source MAC address being replaced with that of a router is a real concern.
Note:
Caution:
Syntax:
set bindtofw {enable | disable} <----- This will check an IP MAC binding combination to allow access TO the firewall.
set undefinedhost {allow | block} <----- This defines how the Firewall will treat traffic that has not been bound.
end
set ip <address_ipv4> <----- IP address value.
set mac <address_hex> <----- MAC address value.
set name <name_str> <----- The name which may be used for this binding.
set status {enable | disable} <----- Is the binding now enabled.
end
config system interface
edit <interface name>
set ipmac {enable | disable } <----- Enable to enable MAC binding on interface.
next
end
Related articles:
Technical Tip: Blocking a MAC address in FortiGate using a Firewall Policy
Technical Tip : How to Block Unknown MAC Addresses without assigning IP addresses in DHCP
