Skip to main content
JJones_VillageMD
JJones_VillageMD
New Member
October 5, 2022
Question

MAC Address usage for Dynamic Firewall Address

  • October 5, 2022
  • 2 replies
  • 2482 views

Hello, In our Policy Package I am trying to create Per-Device mapping for Device MAC address labels as Dynamic Firewall Addresses.

We have templated locations where we keep standard Printer names "FrontDesk, MFP, Label1, Etc. Names will stay the same but the MAC address is different obviously.

 

The problem is that using the MAC Address, we cant see how to reference them in the Policy Package so they never get copied onto the FortiGate when syncing.

 

I attempting to make a group "Printers" and assigning the dynamic objects then applied to a Firewall Policy "placeholder" but the group wont work since they don't contain any IP addresses.

Any direction here.

2 replies

gfleming
Staff
gfleming
Staff
October 5, 2022

Can you show the configuration of one of your printer objects? Perhaps FrontDesk as an example. Please show config of this object and the per-device mapping. 

 

And please clearly explain the error. The group won't work in FMG or it won't work when pushing it to FGT?

JJones_VillageMD
JJones_VillageMDAuthor
New Member
October 5, 2022

Thanks for the quick reply. The objects and group "Printers" work FMG, but wont push to the FGT.

 

Here is the background of the issue in more detail.
When our sites get deployed, we have DHCP reservations created for the Printers and the MAC address labels are created under address objects manually on the device.  If we sync to a Policy Package, it will delete these saved labels since they don't exist in FortiManager. With that said we are trying to map using the Dynamic Firewall Addresses in FortiManager. What we are experiencing is since the Device MAC Addresses are not referenced anywhere in the Firewall Policy they are not getting applied to the device.

 

We are trying to get to only 1 standardized Policy Package and do not want to import Policy Package per device.

 

Here is the Printer Object "FrontDesk"

For MAC Address field the are using a "place holder" since we are only targeting Per Device Mapping

Screenshot 2022-10-05 145615.png

gfleming
Staff
gfleming
Staff
October 5, 2022

OK yea I don't think FMG supports using dynamic address objects in the DHCP Server reservation settings.

 

This is a limitation of FMG that I don't think will let you do what you want.

 

If you reference the MAC address object in a FW policy, it will get installed on the FGT.

 

However, there's no way to reference the MAC address object in the DHCP config (either in system templates or interface config).

JJones_VillageMD
JJones_VillageMDAuthor
New Member
October 5, 2022

Did some trial and error here... Creating a "dummy" firewall policy with a group with the printer dynamic mac addresses seems to be working. We can use this in the future to add additional LAN objects that need referencing.

 

JJones_VillageMD_0-1665005909047.png

 

    Terms & ConditionsAccessibility statement