Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 11 replies
  • Answers 2 answers
  • Subscribers 27 subscribers
  • Views 2145 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Rules firewall MAC

PaLmd

Good afternoon community and thank you in advance.
I want to apply to my network configuration several rules with mac filtering and I do not work, instead the same rule applied to an address ip works correctly.

The assumption is as follows:
I have created two LANs (R1 and R2). Separated from each other and configured in different XG interfaces. What I want is to allow the R2 computers to have access to certain computers in the LAN R1, these computers have registered that mac in XG.

That is to say first I register the mac of the LAN1 equipments in Hosts and services - host mac.

And secondly I create a rule that ALLOWS ACCESS from R2 to R1 and in the section "Destination networks" I add the "mac host" added in the previous step.

That doesn't work for me, I don't know what I'm missing.
On the other hand if I introduce the IP of the equipment, the rule works correctly.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to FormerMember

    First we register the mac in the section [Host and services - MAC host]

    MAC 1--> XX:XX:XX:XX:XX:XX:XX:XX
    MAC 2--> XX:XX:XX:XX:XX:XX:XX:XX
    MAC 3--> XX:XX:XX:XX:XX:XX:XX:XX

    And we have the following networks:

    R1--> 10.0.1.XX
    R2--> 10.0.2.XX

    And I want to allow R2 access to certain devices in R1, filtered by MAC.

    The capture of the firewall rule is as follows:


    This rule does not work, however if instead of the MAC I put the IP of the host works correctly.

    Translated with www.DeepL.com/Translator

  • FormerMember
    0 FormerMember in reply to PaLmd

    Hi Angel Masa,

    Can you please share advanced settings from the firewall rule? 

    Thanks,

  • 0 in reply to FormerMember

    The advanced configuration of this rule is:

    Thanks.

  • 0 in reply to PaLmd

    Hi  

    I believe destination based MAC or MAC list rule will not work and the reason for the same is MAC address never crosses its broadcast domain.

    So in your setup when you initiate any packet from R2 to R1 till R2 Interface on XG it will be one broadcast domain and from R1 Interface of XG to end system it would be another separate broadcast domain.

    so arp -a from any machine of R2 will never give R1 network's ARP learning and vice versa and that's how the layer 2 technology work.

    So better option in your scenario is to restrict the communication by defining the required MAC or MAC list in the source side rather then destination network end in rule.