as discussed in https://community.sophos.com/products/unified-threat-management/astaroorg/f/80/t/64830 you can filter MAC addresses by selecting a MAC address list (in the "Advanced" section within a firewall rule). Such MAC address lists can be defined in "Definitions & Users"->"Network Definitions"->"MAC Address Definitions". There you can import MAC lists, add a single MAC address or add Network-Host objects.
What's New in Sophos UTM 9.1 (Items in bold have been added perhaps since you looked last). Full documentation, release notes, and updated collateral will not be published before the GA release in April
I have red the note, but how should I beta test, when it is a really confusing feature.
So there should be a beta dokumentation about this.
A doc would be fine. My idea is to block every network-device and to allow services for devices by their mac-ids. So the question is how to block mac-addresses by default.
Indeed everything is blocked by default in the firewall rule sets. I suppose to make a practical example of blocking (and no logging) for mac address assignments would have rules set for Laptop1 and Xbox assigned with host addresses using the MAC for each device.
Allowed rules:
Rule 1) source: Laptop1 Service: Any Destination: Any action: allow
Rule 2) source: Xbox Service: any destination: any action: allow
Generic internal drop rule
Rule 3) source: Internal(network) service: any destination: any action: drop
