Technical Tip : How to Block Unknown MAC Addresses without assigning IP addresses in DHCP

[bmedikonda]

Description	This article describes how to block unknown MAC addresses in the network without assigning them an IP address through the DHCP server.
Scope	FortiGate.
Solution	To block unknown MAC addresses without assigning an IP address in DHCP, follow these steps: Enable the DHCP Server: Go to the interface and enable the DHCP server. Access Advanced Options: Navigate to the DHCP server settings and locate the Advanced Options section. Configure IP Address Assignment Rules: Go to the IP Address Assignment Rules section. Locate the Implicit Rule and right-click on it. Set the Action for the implicit rule to Block. Save the Configuration: Apply and save the changes to ensure the new rule is enforced. This configuration will prevent any device with an unknown MAC address from obtaining an IP address. It can be edited via CLI: config system dhcp server     edit 2         set mac-acl-default-action block   <----------- Default action is assigned. end Related articles:  Technical Tip: Blocking a MAC address in FortiGate using a Firewall Policy Technical Note : Configuring MAC address filtering on a FortiGate - IP/MAC binding