MAC addressed-based policies via IPSec Tunnel

Hi Guys, I´m looking for a solution for IPv4 and IPv6 traffic via IPSec that only allows certain clients. (Interfaces are WLAN, LAN or LTE) The prefered soulution is that I can filter the clients with there MAC addresses. I tried it once with this guide: https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies But here I cant get a simple ping through the tunnel if I have address group with the mac. (i dont blacklist or something like that) What do I have to do to get this working? (for IPv4 and IPv6)