Blocking mac addresses on a non-wireless network

Hi Andre,
 
Yes, this is fairly easy.  You need to use device objects in your outbound firewall policies.  Under User & Device > Device Inventory you should be able to see all devices connected on that custom LAN (if not, you need to enable Device Detection under the Interface configuration). 
Create custom objects for each authorized device and then you can use them in your firewall policies.  You can also add them to a group (i.e. AuthorizedDevices) and use that device group in your firewall policies.  That way whenever authorized devices are added or removed all you have to do is change group membership.
 
Let me know if you have any more questions about this.  - Daniel

Hi Andre,
 
Yes, I was assuming you already had a policy allowing traffic from this LAN to the Internet since you said users can statically assign IPs and get out.  You need to *add* the device group to this policy.  This should work even if you're using the "all" address object, but best practice would be to have a custom address object for that subnet used in the policy.
 
Does that make sense?  It's AND logic.  Does your source address match this address object?  If no, this policy is not a match (even if your device is in the device group).  If yes, does your device (i.e. MAC address) also match this device group?  If no, this policy is not a match.
 
- Daniel