any IPv4 policy based on 'MAC address' or "FSSO account' just ignored - FortiGate 200E

Hello

we have a problem with our FortiGate 200E,

the device can filter with IP address without any problem,

but as we have a large number of devices and there is no more "filter by device" shown on device select list,

and we have the same problem if we use FSSO

we stuck with adding some device with MAC Address to Allow,

and sure some devices to deny like mobile devices.

the problem

we create the role without any problem (and we tested it by IP Address and it's work Fine),

but when remove the IP and Add the "MAC Address" (in address) the role just ignored,

if we block a device  - it will keep working

if we allow application for specific device MAC address - the application will not allowed like there is no role run there

Note:

- 'Device detection' is enabled on LAN internal port,

your help will be appreciated,

Thanks in advance

Ahmed