Device Rule doesn't work when users have their default gateway the VLAN interface

[technologist36]

Hello,

I've created a device rule that defines source MAC addresses for managers to have full access to the internet by disabling web filter in this rule. Another rule define source IP addresses for the rest of the users and web filter is enabled in this rule. 

Managers have their default gateway configured as the VLAN interface IP. When they try to access the internet, they hit the second rule and got filtered. When  I changed their default gateways to FG's IP, they hit the first rule and have full access.

This means that FG cannot see the traffic from these MAC addresses when the default gateway is VLAN interface IP. However, the internal interface is configured to identify devices and it can see all devices' MACs.

My goal is to take advantage of the L3 switch routing by configuring it as default gateway instead of FG.

Please advise.