Allowing specific source mac address for VPN

[Ricky_Martin]

Hi Experts,

Kindly advice configuring Fortigate 100E for allowing specific source mac address device for vpn access, pls. suggest.

Thanks

[Toshi_Esumi]

I haven't done but would try below on the VPN policies if you're running 6.2 or above.

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies

[emnoc]

A mac address policy do work but I  advise with mac address changer, anybody can circumvent this.

If you concern about security I would not trust mac address objects I could change my address to match your allow range or place a simple device between me and the "lan" to snat and manually set the src.ether-mac to match you allowed rules.

How we would find possible src mac.addr is to do a passive sniff on the interface and record the vendor mac address that are used.

Ken Felix

[Ricky_Martin]

Thank emnoc 

As I know, our users are not that mature to manipulate the mac but it adds one addl. layer of security, kindly advice whether domain users can be allowed using their own credentials for accessing vpn?

[Yurisk]

Sure, you can authenticate VPN users against internal Active Directory/LDAP server. You create LDAP server object, then use it in USer Group, which in turn you put in VPN rules as the source.

As already said MAC filtering is not reliable, and I would say more pain than gain. If you strive to restrict users to connect only from specific PCs/hosts, I'd rather use PKI/user certificate authentication - you install user/individual certificates on each user machine w/o option to export such certificate. This way, in addition to password, a user will have to connect from the host which has its certificate installed.

[ede_pfau]

...but there are downsides to cert-based VPN:

- certs expire, so you have to monitor the age of all issued certs. Depending on the number of supported devices, this could mean a lot of effort

- a regular user is not knowledgeable enough to install a cert

- which means he/she will have to bring the device in to have you install it. And repeatedly because the cert has a definite lifespan

- physical access to the remote device means loss of that additional layer of security (as with mac-based security as well)

[Ricky_Martin]

Thank toshiesumi 

Tried this steps earlier from the same link provided earlier but no luck, will do it again and let you know.  meantime pls. advice to allow domain users to use their credentials accessing vpn, can be done in 6.2 ver?