- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how to block mac address?
I blocked user MAC Reservation + Access Control, but if the user sets himself a static IP address, it uses the Internet and network.How to fix?
Fortigate 80c
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can block the internet access by creating a device and a policy to block the device
Go to User&Devices > Device > Device Groups and Create New and create a "blockedMac" Group
Go to User&Devices > Device > Device Definitions and select Create New (or look if it's already listed if you have Detect and Identify Devices on on the interface)
Now go to Policy&Objects > Policy > IPv4 and Create new
[ul]
Repeat this if your servers are in a different subnet/interface for the interface
Sadly your firewall cannot block internal traffic within the same subnet since the traffic literally does not cross the Fortigate
If your FortiGate does DHCP you can go to System > Monitor > DHCP
Look for the device in question and right click it and select Create/Edit IP Reservation
Set the Action to Block
But as you said the user can simply use a static IP
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only way I know of is to set up a MAC reservation. If the user changes his IP address, then the reservation is broken and the traffic won't flow. I believe this is the behavior, but I may be wrong.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can block the internet access by creating a device and a policy to block the device
Go to User&Devices > Device > Device Groups and Create New and create a "blockedMac" Group
Go to User&Devices > Device > Device Definitions and select Create New (or look if it's already listed if you have Detect and Identify Devices on on the interface)
Now go to Policy&Objects > Policy > IPv4 and Create new
[ul]
Repeat this if your servers are in a different subnet/interface for the interface
Sadly your firewall cannot block internal traffic within the same subnet since the traffic literally does not cross the Fortigate
If your FortiGate does DHCP you can go to System > Monitor > DHCP
Look for the device in question and right click it and select Create/Edit IP Reservation
Set the Action to Block
But as you said the user can simply use a static IP