How to block MAC Adress

[RegiLu]

Hi all,

I've got a problem.

I want to block mac adress of PC in LAN network.

On Fortigate 100E isn't DHCP server.

Forti OS 5.6.4

I created a device with specific mac adress.

I added this device to a device group (blocked macs) , and finally i used this group in IP v4 policy :

[ul]

Incoming Interface: LAN

Source Address: all

Outgoing Interface: wan (your internet connection)

Source : "BlockedMac" and subnet 10.10.10.0/24

Service: All

Action: Deny[/ul]

But this not work.

Any ideas ?

THX

[lobstercreed · Accepted solution]

You stated the FortiGate is not the DHCP server, but is it the default gateway for the subnet where the host you want to block resides?  If there is any other L3 device between the FortiGate and the blocked host, it simply cannot be done.

What you described cannot be done if:  BAD_GUY <-->  SOME_ROUTER  <-->  FGT  <--> WAN

What you described should work if:  BAD_GUY  <-->  FGT  <--> WAN

However, even in the latter scenario, it will only prevent Internet-bound traffic.  It won't truly block the device...i.e. it wouldn't prevent internal traffic.

[lobstercreed · Accepted solution]

You stated the FortiGate is not the DHCP server, but is it the default gateway for the subnet where the host you want to block resides?  If there is any other L3 device between the FortiGate and the blocked host, it simply cannot be done.

What you described cannot be done if:  BAD_GUY <-->  SOME_ROUTER  <-->  FGT  <--> WAN

What you described should work if:  BAD_GUY  <-->  FGT  <--> WAN

However, even in the latter scenario, it will only prevent Internet-bound traffic.  It won't truly block the device...i.e. it wouldn't prevent internal traffic.

[Dave_Hall · Accepted solution]

Hi Regi.

Firewall policies are executed from top-to-bottom - have you placed the block device rule somewhere near the top of the firewall list?

[RegiLu]

Hi Dave,

Yes, the policy is near top of the tree.

But I think the problem , in this case  , is the router beetween BGUY and FGT , how wrote lobstercreed.

Any ideas : how, in this scenario (BGUY - ROUTER - FGT - WAN) , block this guy from any traffic internet and internal?

[RegiLu]

Hi lobstercreed ,

Thank you for your answer. 

I think you are right.

So, have you maybe any ideas, how to block BGUY in this scenario (BAD_GUY <--> SOME_ROUTER <--> FGT <--> WAN) from any traffic (internal, internet) ?

Regards

Regi

[lobstercreed]

Hi Regi,

Unfortunately what you're asking is absolutely not possible to do with the FortiGate using your current topology.  This goes back to the fundamentals of network design...I'd recommend refreshing yourself on how Layer 2 (switching) and Layer 3 (routing) devices work. 

However, here are some things you CAN do, depending on what else you have in your environment.  I'll try to order them from easiest to hardest:

1) Assuming you're running DHCP, make sure that your DHCP server hands the bad guy a specific IP address on each subnet he could connect to.  Create address objects in the firewall for those addresses, and use them in your deny policy.  This cannot block internal traffic, and the bad guy can get around it by using a different, static IP address, but it could be somewhat effective.

2) Assuming you're using managed switches, use a Layer 2 ACL to block the mac address on all ports.  This will vary significantly from vendor to vendor, but most have at least some way to do this.  This is really the only way to truly block the bad guy both internally and on the internet.  This would really have nothing to do with the FortiGate (unless you're using FortiSwitches also).

3) Change your topology so that the FortiGate IS the default gateway for the subnet(s) where the bad guy may be.  This has serious ramifications for your network, especially as it regards how much capacity your FortiGate can handle vs how much inter-VLAN bandwidth you need.  If you have sufficient capacity though, this can get you much closer to what you want.  We use this design at the school I work at. 

However, depending on physical topology again, you may only succeed in blocking the bad guy from accessing the Internet (and/or other parts of your network).  Per the principles of layer 2 forwarding, he would still be able to talk to other hosts on the same VLAN through whatever switches you're using unless you're doing additional port security on managed switches like I mentioned in option 2.

I hope that helps.  Just remember the MAC address is not visible on the other side of a subnet boundary (i.e. router/default gateway).  https://www.quora.com/How-does-the-router-know-the-destination-Mac-address

- Daniel Hamilton