#Sophos XG Firewall How to block internet access based on MAC Address | Sophos XG IP Based Policy

Sophos XG Firewall How to block internet access based on MAC Address | Sophos XG Firewall Mac Based Policy for Internet | IP Based policy for Internet
Online Class For Sophos Firewall please Email Me on rajgiddi143@gmail.com
Skype: rajpanipat123

Sophos XG Firewall: How to block internet access based on MAC Address
Overview
MAC address filtering is more secure than IP address filtering, as MAC addresses are rarely changed. In an environment with DHCP, the IP addresses of hosts change dynamically, so filtering MAC addresses are more reliable and feasible to identify and filter the source and destination of network traffic.

In a wireless environment (WLAN), the most common security measure to prevent unwanted network access is MAC address filtering. Here, the router is configured to only accept traffic from the specific MAC addresses, and allow listed devices are assigned new IP addresses through DHCP. This way, the hosts retain their ability to communicate with the Network. Any attempt to communicate by masquerading the IP address is blocked as the attacker’s MAC address will not match with the MAC address of allowing listed devices.

How to block access based on MAC address

1. Go to Hosts and Services MAC Host and click Add to add a MAC host. Enter the parameters as shown in the table below:
Parameters Value Description
Name MAC_Host Specify a name to identify the Group.
Type MAC Address Specify the MAC Type.
MAC Address 00-0C-29-8E-FE-DC Specify the MAC Address of the host.

2. Click Save to add the MAC host.
3. Navigate to Firewall, and click + Add Firewall Rule. Select User/Network Rule to add a new rule as shown in the image below.
4. Click Save to add the rule.

This rule blocks entire IPv4 traffic for the MAC host 00:16:76:49:33:CE originating from LAN and destined for WAN.
Note: MAC-based internet filtering works only when the network nodes are directly connected to the Sophos Firewall. In network scenarios where the nodes are connected via a firewall, router, or a layer 3 switch, User-MAC binding must be enabled.

source

mac address