Mac filter

[coffe]

Hi, I wanted to know if it is possible to use a fortigate 60d to make a list off known MAC addresses in my network. Then block out the device if an unknown MAC address asks for an IP address. Thanks in forward \_/>

[abc987]

There is a possible way: 1. reserve IP' s for all known stations (MAC) in CLI:

config system dhcp server
 edit <server_index_int>
  config reserved-address
   edit <id_int>
   set ip <ipv4_addr>
   set mac <mac_addr>

2. make a policy in WebGUI that allows traffic only for this reserved IP' s

[ede_pfau]

That won' t work as expected. Say, I reserve 192.168.44.10 to MAC1. Assuming, this host is not online at the moment an intruder hard-codes 192.168.44.10 on his notebook, and of course the FGT allows access as it is using an allowed IP address. But...in CLI there are 2 settings which control IP-MAC bindings. One of them, if enabled, prohibits traffic through the firewall if the IP address is not matching the MAC address from a previously defined IP-MAC-binding. (the other does the same for traffic directed towards the FGT itself).

 config firewall ipmacbinding setting
     set bindthroughfw disable
     set bindtofw disable
 end
 

One other way to employ this is to block a known MAC address: just create an IP-MAC pair with a " foreign" IP address (10.111.111.111) where this IP address is not routed on your LAN (and not known to your FGT in any route). If that host uses any routed, correct IP address in your LAN it' s still blocked at the firewall as the pair doesn' t match. There is just one thing I don' t know (and haven' t tested yet, or forgot): if a MAC used is NOT found in a Reserved IP-MAC pair, is that traffic blocked then?

[abc987]

config firewall ipmacbinding setting

... and configuring also

config firewall ipmacbinding table

But at least MAC filters will not be safe. IP' s and MAC' s are configurable...