Created on
05-15-2022
10:26 PM
Edited on
01-09-2025
10:17 PM
By
Jean-Philippe_P
Description | This article describes how to use FortiGate to block network access for mobile phones (Android, iOS/iPadOS). This may be useful to prevent non-managed devices from accessing network resources through the FortiGate. |
Scope | FortiOS version 6.4+. |
Solution |
Method 1: Application Control.
Application Control has signatures available that allow the FortiGate to identify a device's operating system based on certain patterns of traffic that it transmits. With this, it is possible to prevent mobile devices from sending traffic through FortiGate by applying an Application Control profile to the FortiGate Firewall Policies.
Note: Modern devices are almost exclusively using HTTPS and other encrypted protocols to communicate with services over the network and the Internet. This encryption will hide many identifiable aspects of the devices' traffic and will largely prevent Application Control from being able to detect traffic on its own.
To combat this, TLS Deep Inspection must be applied to the Firewall Policy to allow the FortiGate to act as a Machine-in-the-Middle and decrypt encrypted user traffic. However, this will generate TLS errors/warnings on any device matching these Firewall Policies unless they have FortiGate's CA certificate installed (see here for more information: SSL/TLS deep inspection).
To use this method, use the following steps:
Method 2: MAC Address Objects in Firewall Policies.
In FortiOS 7.0 and later, it is possible to configure MAC-based Address Objects that can be used in Firewall Policies to govern access.
Note: MAC Address objects can only be used when the device to be allowed/blocked is on the same Layer 2 broadcast domain as the FortiGate. If the device is located behind another Layer 3 device (such as a core switch or router) then the FortiGate will not have visibility into the device's MAC address and the object/policy will never be matched. 1. Go to Policy & Objects -> Addresses, select the Address section, then select Create new. 2. Set an appropriate Name, then change the Type to 'Device (MAC Address)'. 3. Enter the MAC address of the device to be matched (or a range of MAC addresses), then select OK to commit the changes.
4. Go to Policy & Objects -> Firewall Policy and create/modify a Firewall Policy. 5. Apply the new MAC Address object in the Source field, then set the Action appropriately (the Accept action to allow incoming Sources using this MAC Address, or Deny to drop traffic matching the specified MAC Address).
|
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.