Skip to main content
Marcos_FDS1012
New Member
February 7, 2025
Solved

Release DHCP only when the machine's MAC has been fixed together

  • February 7, 2025
  • 3 replies
  • 1055 views

I need to make it so that when a machine plugs a network cable into my network it can't get an IP via DHCP, but when I register the machine's MAC it can use my NETWORK, how could I do that?

Best answer by funkylicious

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-control-DHCP-user-via-MAC-address/ta-p/195304 

  • Action for 'Unknown MAC Address' as 'Assign IP' or 'Block IP' can be set (recommendation will be to set the action as block IP).

this will limit the assignment of DHCP to the devices. use with caution tho, it can deny DHCP to any devices that should be permitted if they are not reserved ahead of time.

 

anothet thing, https://docs.fortinet.com/document/fortigate/7.2.0/new-features/59285/add-vci-pattern-matching-as-a-condition-for-ip-or-dhcp-option-assignment-7-2-1 to look for patterns in the dhcp request 

 

another thing if your network supports, would be dot1x ( 802.1x ) with port-security 

3 replies

funkylicious
SuperUser
SuperUser
February 7, 2025

what acts as a dhcp server in your network ?

is it the FortiGate or another device ?

"jack of all trades, master of none"
Marcos_FDS1012
New Member
February 7, 2025

And fortegate that it's my DHCP

funkylicious
SuperUser
SuperUser
February 7, 2025

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-control-DHCP-user-via-MAC-address/ta-p/195304 

  • Action for 'Unknown MAC Address' as 'Assign IP' or 'Block IP' can be set (recommendation will be to set the action as block IP).

this will limit the assignment of DHCP to the devices. use with caution tho, it can deny DHCP to any devices that should be permitted if they are not reserved ahead of time.

 

anothet thing, https://docs.fortinet.com/document/fortigate/7.2.0/new-features/59285/add-vci-pattern-matching-as-a-condition-for-ip-or-dhcp-option-assignment-7-2-1 to look for patterns in the dhcp request 

 

another thing if your network supports, would be dot1x ( 802.1x ) with port-security 

"jack of all trades, master of none"
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!