Skip to main content
shcee0
shcee0
New Member
June 21, 2023
Solved

mac addressed-based policy is works on fortigate 200E 6.4.11?

  • June 21, 2023
  • 9 replies
  • 5087 views

hello, 

My company uses Fortigate 200E equipment and the version is 6.4.11.
Forticare support is the only license that is active, and IPS, Antivirus, and Web filtering are not licensed.

I want to control the VPN connect that accesses based on the Mac address.

Can I make a policy based on Mac address without a separate license?

 

I think the Mac address-based access control policy does not require any license from various sources,

but I asked because it is an environment where testing is not possible. Please give us a lot of help.

 

thank you.

Best answer by rmreddy

Hi,

As you are configuring for SSLVPN using MAC based

Please follow the below link for your reference how to restrict VPN based on MAC address.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-Address-check-on-SSL-VPN-connections/t...

However, follow the below link regarding the MAC binding supported platforms for your reference.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platforms/ta-p/196088https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platf...

 

If you are using forticlient below v6.2, then license is not required, however if you are using above v6.2 EMS license is reauired.
Please go through the link provided regarding MAC supported platform.

9 replies

rmreddy
Staff
rmreddy
Staff
June 21, 2023

Hi,

Please follow the below link for your reference how to restrict VPN based on MAC address.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-Address-check-on-SSL-VPN-connections/ta-p/194337

However, follow the below link regarding the MAC binding supported platforms for your reference.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platforms/ta-p/196088

shcee0
shcee0Author
New Member
June 22, 2023

Mac-based access control requires a license.

but I couldn't find the license information for the 6.4 version.

 
srajeswaran
Staff
srajeswaran
Staff
June 21, 2023

Hello @shcee0 ,

MAC address based policies don't need any special licensing.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-the-MAC-address-based-policies-in/ta-p/194591
https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies

shcee0
shcee0Author
New Member
June 22, 2023

That method(link) is incorrect. If I only insert a mac object, the following message prevents me from creating a policy : One user or group is required. Therefore, I must add at least one account(user). I did, but this is only working on my account base, not on my actual Mac address base.

 

이미지 2.png

rmreddy
Staff
rmreddy
Staff
June 21, 2023

Hi,

However, if you are looking for normal IPV4 policy, you can refer the below link for your reference where special licensing is not required.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-the-MAC-address-based-polici...
https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies

shcee0
shcee0Author
New Member
June 22, 2023

That method(link) is incorrect. If I only insert a mac object, the following message prevents me from creating a policy : One user or group is required. Therefore, I must add at least one account(user). I did, but this is only working on my account base, not on my actual Mac address base.

 

이미지 2.png

shcee0
shcee0Author
New Member
June 22, 2023

I don't know which information to believe.
Whether a license is required or not.

rmreddy
Staff
rmreddyAnswer
Staff
June 22, 2023

Hi,

As you are configuring for SSLVPN using MAC based

Please follow the below link for your reference how to restrict VPN based on MAC address.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-Address-check-on-SSL-VPN-connections/t...

However, follow the below link regarding the MAC binding supported platforms for your reference.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platforms/ta-p/196088https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platf...

 

If you are using forticlient below v6.2, then license is not required, however if you are using above v6.2 EMS license is reauired.
Please go through the link provided regarding MAC supported platform.

    shcee0
    shcee0Author
    New Member
    June 22, 2023

    then... you mean i need license.

    thank you. 

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!