Mobile deny for specific network

[Alxndr3]

Hi!

I would like to deny the access to the internet for smarphones.

I've created a device based rule, for while to block the access from all networks, however it's not working.

[EMES]

Do you have device detection enabled on the interface facing your users? also how is your network layed out, is the fortigate the gateway for the subnet where the mobile users reside?

[Alxndr3]

Yes, it`s enabled, the gateway is a core switch. I have only one fortigate`s interface (lan) connected to that swich.

[Dave_Hall]

Hi Alexandre.

Can't tell from your screenshot if you have set the action to deny on those polices nor able to tell if you have set a schedule.  Are there any firewall polices above those policies in question that may be allowing general device traffic through.?

[Alxndr3]

Hi Dave, Thanks for your response.

Yes I've set the deny, but no for the schedule, above these rules there are two active ones.

[Dave_Hall]

I suggest reviewing the address values for Sevidor Camera, DISPAR - Rede Portaria, and Rede DATACenter.  If these firewall addresses are single IP4 addresses, the subnet mask should be /32 rather than /24 (unless that is what you want).

[Alxndr3]

Thank you, I'll review. Any suggestions about the mobile-deny?

[Dave_Hall]

A few questions in the back of my head, but was wondering if you had created a "wildcard" address firewall label by mistake for your source address(es) in policy #18. 

What is the default gateway address assigned to your mobile devices? 

Have you confirmed these mobile devices are able to access the Internet?

Have you drilled down to individual traffic sessions for any of these mobile devices?

Have you checked the routing monitor and/or confirmed the proper routes are in place?

Do you have any routing policies in place that may be affecting your mobile devices traffic?

Are your mobile devices connection(s) on a separate VLAN?

[tanr]

What version of FortiOS are you running?

I've struggled quite a bit with device identification with 5.4.8.  It has regularly failed to identify iOS devices allowing those devices to fall through to other firewall rules.

I've worked around this in three ways as I experimented with it:

1. Created specific custom devices for known iOS devices and made rules just for them

2. Have a wifi ssid interface just for the mobile devices I want to limit

3. Require that all non-mobile users authenticate and use group membership 

[Alxndr3]

Dave

A few questions in the back of my head, but was wondering if you had created a "wildcard" address firewall label by mistake for your source address(es) in policy #18. No wildcard for police 18 addresses   What is the default gateway address assigned to your mobile devices? My core switch 10.241.10.253, which forwards all packages to fortigate's lan interface 10.241.10.1 Have you confirmed these mobile devices are able to access the Internet? Yes, they can access the internet Have you drilled down to individual traffic sessions for any of these mobile devices? I think so, there is no traffic interruption for any specific device.  Have you checked the routing monitor and/or confirmed the proper routes are in place? Routes in place Do you have any routing policies in place that may be affecting your mobile devices traffic? The trafic flows no problem Are your mobile devices connection(s) on a separate VLAN? Yes, I have a separated vlan for theses devices e.g. DISPAR - Rede Portaria 60.x from police 18 is vlan 60 10.241.60.0/24 and the mobiles vlan 100 is 10.241.100.0/22

I've followed the followind procedures to set up that police:https://docs.fortinet.com/uploaded/files/2013/allowing-network-access-based-on-schedule-and-device-t...

It's supposed to work, isn't it?

Tanr My FortiOS version is  v5.6.3 build1547 (GA)