This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

mac host based firewall rule - inter vlan

Hello Gents,

SFOS 17.5.7 MR-7

I've created mac host based firewall rule, inter two vlans, and it is not working,
when I'm testing it, in a policy test window, name typed as a mac host name is resolving correctly to a IP address, but it is still blocked.

This problem occurs on both sides, rule works only when i put IP host in the rule.

What could be the issue?

This thread was automatically locked due to age.

0 Keyur over 6 years ago

Hi Patryk Dobrowolski

If you have Layer-3 device/switch in your network and request route via that device to firewall than actual MAC of the device will not hit the firewall and MAC-based firewall rule will not work in this scenario.
Cancel
Vote Up 0 Vote Down

Cancel
0 Patryk Dobrowolski over 6 years ago in reply to Keyur

Hi,
no i have layer 2 switch, and UTM correctly resolves username to mac address what is seen on the picture attached
Cancel
Vote Up 0 Vote Down

Cancel
0 Badrobot over 6 years ago in reply to Patryk Dobrowolski

Can you place the rule at the top?
Cancel
Vote Up 0 Vote Down

Cancel
0 Badrobot over 6 years ago in reply to Badrobot

you could also make the rule work with IP address to see if it does go through, then it id does the issue is with the mac.
Cancel
Vote Up 0 Vote Down

Cancel
0 Badrobot over 6 years ago in reply to Patryk Dobrowolski

Also I do not see any mac addresses in either image.
Cancel
Vote Up 0 Vote Down

Cancel
0 Patryk Dobrowolski over 6 years ago in reply to Badrobot

Hi Badrobot,

i tested rule with IP address and its working ok,
my mistake was that i typed as mac host name domain name of pc, that's why it was resolving, but after change don't.
Now policy test shows me error "An error has occurred in resolving the URL, please update the URL and retry the policy test."
I think it should resolve it somehow, because this unit serves me as a router and dhcp server, and in leased IP i see clearly all the macs that i need.
Cancel
Vote Up 0 Vote Down

Cancel
0 Badrobot over 6 years ago in reply to Patryk Dobrowolski

Are you sure the host name is correctly entered in DNS?
Cancel
Vote Up 0 Vote Down

Cancel
0 Patryk Dobrowolski over 6 years ago in reply to Badrobot

Which host name?
mac host name, or pc domain name?
mac host name are set in Mac host tab
and pc domain name are in windows dns server, of course xg is looking there as a first source
Cancel
Vote Up 0 Vote Down

Cancel
0 Badrobot over 6 years ago in reply to Patryk Dobrowolski

You can join the mac to the domain, or have the mac host name setup properly in the windows DNS.

I do not know your specific setup but I would look into adding the host name to the DNS, or joining the MAC to the domain, whichever works best. If I remember right Windows DNS will not let non-domain machines update DNS unless you tell it to. Either way aside from this discussion a solid DNS will only help you later, believe me.

You can look around as well but to show one example https://community.sophos.com/products/xg-firewall/f/network-and-routing/95100/dns-best-practices-for-xg

I would also make sure the XG DNS is setup correctly.
Cancel
Vote Up 0 Vote Down

Cancel
0 Patryk Dobrowolski over 6 years ago in reply to Badrobot

Badrobot it is about mac address as shown on screenshots not a macbook :)
Cancel
Vote Up 0 Vote Down

Cancel