Firewall Rules on Device Objects ?

[chrbar]

Hello, We can create Device Objects with MAC Address information. Can we use these Device Objects inside a Firewall rule, to deny Internet access? I've created a Device and added it into Authentication of a rule that deny FTP/HTTP/HTTPS Services to Internet. But this rule doesn't catch this device Internet browsing. Do I have to install the FortiClient on this device to be able to use Device Objects into Firewall rules? Regards, Chris

[Jeff_FTNT]

You may just enable "device-identification"  on interface, FGT will detect MAC/OS information.

config system interface     edit "port11"         set device-identification enable end

Add  "device-group"  to policy .

Some diag CLI : # dia user device xxx,

Hope is helpful, thanks