2

I'm not very familiar with firewalls. I have a "fortigate 90d". I must simply prohibit access to the internet (via wired network) to a group of about twenty pc. This ban must be made by mac address of PC. this rule must be turned on or off at any time. Who can help me please? I add a clarification: Current Running Firmware: FGT90D-5.00-build318.

I have followed this excellent tutorial http://cookbook.fortinet.com/mac-access-control/ but the web interface does not match the tutorial because based on newer firmware.

These are interfaces: interfaces

  • 1
    If your PC's gateway is not the firewall, it can't be done. Most likely it can't be done anyway. Firewalls usually operate at later three or higher. – Ron Trunk Mar 16 '17 at 22:48
  • @ron-trunk My PC's gateway is the firewall. – nicovon Mar 20 '17 at 8:29
2

The mentioned solution in the link will not do the job, you need to do the below:

  1. collect the MAC addresses of devices
  2. Creating a device group as mentioned by the link: Go to User & Device > Device > Device Groups and create a new group. Add the new device to the Members list with their MAC addresses 3.Create security policy and configure its action as deny Go to Policy & Objects > Policy > IPv4 and create a new policy. Set Incoming Interface to your LAN interface, Source Device Type to the device group, and Outgoing Interface to the Internet-facing interface and set the destination to any and the action to drop
  3. confirm that the created policy position is on the top of the policies
  • 1
    @mr-lock Thanks! I have difficulty because the web interface is a bit different from what you have described. I am attaching a photo in the main topic. – nicovon Mar 20 '17 at 8:50
  • In the source address when you click on the click to add, can you give screen shot for that ? – Mr.lock Mar 20 '17 at 9:36
  • @mr-lock i.stack.imgur.com/3Z8Vo.jpg – nicovon Mar 20 '17 at 11:41
  • Please check device idintity – Mr.lock Mar 20 '17 at 15:26
  • @mr-lock i.stack.imgur.com/Nz15k.jpg – nicovon Mar 21 '17 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.