Device detection when routed

[ricdgr]

Hi, I have a Fortigate running on my network edge. My internal devices connect to an internal router (actually a Cisco 6500). Because of the former, the fortigate cannot see the mac addresses of the devices, just the one from the router. Is there a way to use the device detection features with this topology (maybe using a on-arm sniffer interface and a span on the router)? What would be the best setup to do it? Thanks

[emnoc]

1st question, Why? What are you trying to do that requires thee need for mac_address? if you need mac_address, don' t use the 6500 as a layer3 vlan interface, and just pass the clients vlans over to the FGT.

[ricdgr]

Hi, It' s not me that want to get mac-address, but the Fortinet Device Control feature. When routed, I can only see a single device in " User & Device > Device > Device Definition" , with the mac address of my internal router. Regards

[Carl_Wallmark]

For Device Detection to work, you need to have a L2 network against the FortiGate, you cannot have a router or nat' ed device in between, then all devices would have the same MAC address. The feature works best in a small office/network that don´t require L3 switches etc...