I need help in setting up my network, currently I have the following setup.

enter image description here

All the computers can browse the internet but when I tried to create a two groups (a group that can access the internet and a group that can't access the internet) using Device MAC Access Control but to no avail still all the computers can access the internet. I follow the instructions in the Fortigate Cookbook (FORTI OS 5.4), Fortigate seems cannot recognize/identify MAC Addreses of the computers int the network

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 31, 2020 at 4:36

2 Answers 2


Since you route your VLANs on the SG300, the Fortigate can't ever see the client's MAC address. All it can see is the SG300's MAC address on VLAN 1 (which you've probably permitted so everyone gets through). MAC addresses are only meaningful within their layer 2 segment/VLAN, they simply cease to exist outside.

(When a MAC frame is passed to a router, the router strips the IP packet from the frame and when forwarding it encapsulates the packet in a new frame with its own MAC as source.)

I wouldn't use MAC-based authentication. Using reserved DHCP addresses on the DHCP server maps the MAC addresses to specific 'static' IP addresses. These you can use on the Fortigate. To prevent a client to use a fake IP address you can use DHCP snooping and MAC binding in the SG300 (not sure if the SG300 supports this though).

If you do need to do this based on clients' MAC addresses you'll need to extend the VLANs up to the Fortigate. This however produces the problem that the LAN clients would need to use the Fortigate as default gateway towards the Internet but the SG300 as gateway for the LAN subnets. Routing everything through the Fortigate would work but is probably not what you want.

If you can't set up a static route for on the clients pretty much your only bet is to rely on ICMP redirects (causing each Internet connection's first packet to be lost).

Another option would be to use the Fortigate's single sign-on feature and have the client authenticate towards a Windows AD or such.

Yet another option is to apply MAC-based filtering on the L3 switch but that's not a good design - you'd be splitting forwarding decisions between core switch and firewall.


Instead of segregating internet traffic based of specific Vlan mac-address .

We can even accomplish this requirement by framing outbound policy in fortigate firewall allowing souce as specific Vlans subnet which requires internet access . Remaining Vlan subnet won't have access internet beacuse there is no outbound security policy in fortigate firewall .

For example

Source interfàce : ingress interface (LAN) Souce address : Vlans subnets(which requires internet access)

Destination interfàce: egress interface

Destination address : Any

Action : allow

Service :https

Security profiles : Enabled ..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy