mac addressed-based policy is works on fortigate 200E 6.4.11?

[shcee0]

hello, 

My company uses Fortigate 200E equipment and the version is 6.4.11.
Forticare support is the only license that is active, and IPS, Antivirus, and Web filtering are not licensed.

I want to control the VPN connect that accesses based on the Mac address.

Can I make a policy based on Mac address without a separate license?

I think the Mac address-based access control policy does not require any license from various sources,

but I asked because it is an environment where testing is not possible. Please give us a lot of help.

thank you.

[rmreddy]

Hi,

Please follow the below link for your reference how to restrict VPN based on MAC address.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-Address-check-on-SSL-VPN-connections/t...

However, follow the below link regarding the MAC binding supported platforms for your reference.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platf...

[shcee0]

Mac-based access control requires a license.

but I couldn't find the license information for the 6.4 version.

https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/407159/mac-addressed-based-p... 

[srajeswaran]

Hello @shcee0 ,

MAC address based policies don't need any special licensing.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-the-MAC-address-based-polici...
https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies

[shcee0]

That method(link) is incorrect. If I only insert a mac object, the following message prevents me from creating a policy : One user or group is required. Therefore, I must add at least one account(user). I did, but this is only working on my account base, not on my actual Mac address base.

[rmreddy]

Hi,

However, if you are looking for normal IPV4 policy, you can refer the below link for your reference where special licensing is not required.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-the-MAC-address-based-polici...
https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies

[shcee0]

That method(link) is incorrect. If I only insert a mac object, the following message prevents me from creating a policy : One user or group is required. Therefore, I must add at least one account(user). I did, but this is only working on my account base, not on my actual Mac address base.

[shcee0]

I don't know which information to believe.
Whether a license is required or not.

[rmreddy · Accepted solution]

Hi,

As you are configuring for SSLVPN using MAC based

Please follow the below link for your reference how to restrict VPN based on MAC address.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-Address-check-on-SSL-VPN-connections/t...

However, follow the below link regarding the MAC binding supported platforms for your reference.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-client-MAC-binding-supported-platf...

If you are using forticlient below v6.2, then license is not required, however if you are using above v6.2 EMS license is reauired.
Please go through the link provided regarding MAC supported platform.

[shcee0]

then... you mean i need license.

thank you.