Mac filter

Hello Henock,

Thank you for contacting the Sophos Community.

Is this Firewall rule you created above the rule you created by selecting known match users?

Regards,

yes it is the first rule

So you have two different firewall rules, one with MAC the other with authentication. 

Authentication is using "Match unknown users" & "Promt Authentication if not known"? 

Are you 100%, the used MAC is correct? Could you verify this with a packet capture? 

when i read some of the posts i get the device must be directly connected to sophos xg firewall otherwise mac-binding must be configured is that correct ?

https://community.sophos.com/kb/en-us/123042

Note: MAC-based internet filtering works only when the network nodes are directly connected to Sophos Firewall. In network scenarios where the nodes are connected via a firewall, router or a layer 3 switch, User-MAC binding must be enabled. For details, please refer to the article in the related information section below.

when i read some of the posts i get the device must be directly connected to sophos xg firewall otherwise mac-binding must be configured is that correct ?

https://community.sophos.com/kb/en-us/123042

Note: MAC-based internet filtering works only when the network nodes are directly connected to Sophos Firewall. In network scenarios where the nodes are connected via a firewall, router or a layer 3 switch, User-MAC binding must be enabled. For details, please refer to the article in the related information section below.

Hi Ihenock 

Yes that's true when end machine is behind any L3 device (via a firewall, router or a layer 3 switch) during that MAC based rule will not work. As on XG source MAC will not be of end user due to L3 device present over network path between client system and XG. If this is the case with current setup then unfortunately it is not possible to have Internet access without authentication for specified mac address list in LAN to WAN rule.

let me tell you my scenario there are 4 special users and they didn't join Active directory. i use STATS for authentication i want these users to pass with out authentication. is there a possible way to do so

Hi Ihenock 

I have another way if that helps you:

You may add static DHCP entry on XG or server who is acting DHCP server in your network for this 4 users machines or devices. So they will get the fixed IP all the time. You may create a Clientless user for this IP and they do not required login as Clientless users will be in live users only. 

Clientless users are the users who can bypass the client login to access the Internet and are managed by the device itself.

https://docs.sophos.com/nsg/sophos-firewall/v16058/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/ClientLessUserManage.html

Hello

It helps however imagine i have a L3 Router which gives DHCP 10.10.10.0/24 and my firewall is in 192.168.100/24 if i create Clientless user should i enter the 10.10.10.0 subnet.