mac host based firewall rule - inter vlan

Hi Patryk Dobrowolski 

If you have Layer-3 device/switch in your network and request route via that device to firewall than actual MAC of the device will not hit the firewall and MAC-based firewall rule will not work in this scenario.

Hi,
no i have layer 2 switch, and UTM correctly resolves username to mac address what is seen on the picture attached

Can you place the rule at the top?

you could also make the rule work with IP address to see if it does go through, then it id does the issue is with the mac.

Also I do not see any mac addresses in either image.

Hi Badrobot,

i tested rule with IP address and its working ok,
my mistake was that i typed as mac host name domain name of pc, that's why it was resolving, but after change don't.
Now policy test shows me error "An error has occurred in resolving the URL, please update the URL and retry the policy test."
I think it should resolve it somehow, because this unit serves me as a router and dhcp server, and in leased IP i see clearly all the macs that i need.

Hi Badrobot,

i tested rule with IP address and its working ok,
my mistake was that i typed as mac host name domain name of pc, that's why it was resolving, but after change don't.
Now policy test shows me error "An error has occurred in resolving the URL, please update the URL and retry the policy test."
I think it should resolve it somehow, because this unit serves me as a router and dhcp server, and in leased IP i see clearly all the macs that i need.

Are you sure the host name is correctly entered in DNS?

Which host name?
mac host name, or pc domain name?
mac host name are set in Mac host tab
and pc domain name are in windows dns server, of course xg is looking there as a first source

You can join the mac to the domain, or have the mac host name setup properly in the windows DNS.

I do not know your specific setup but I would look into adding the host name to the DNS, or joining the MAC to the domain, whichever works best.  If I remember right Windows DNS will not let non-domain machines update DNS unless you tell it to.  Either way aside from this discussion a solid DNS will only help you later, believe me.

You can look around as well but to show one example https://community.sophos.com/products/xg-firewall/f/network-and-routing/95100/dns-best-practices-for-xg 

I would also make sure the XG DNS is setup correctly.

Badrobot it is about mac address as shown on screenshots not a macbook :)

I do not see a mac address in either screen shot.