[USG Flex H] - Whitelisting/Blocklisting MACs address to join into network

Maverick87

Hello everyone,
there is a possibility to whitelist or blocklist some mac address to join into network?

I mean, if I would like to deny some mac address (on an physical eth or on a Wifi AP) to prevent to access to my network/subnet/VLAN, there is a possibility to deny or allow a mac address to join into?

I can allow/deny some services based on an IP Address, but in this case I need an IP reservation and I need to know the mac address beforehand.

Thank you

Zyxel_Melen

Hi @Maverick87

If you focus on USG FLEX H, rather than adding a switch to setup MAC authentication, then you might need to:

1. Setup the static DHCP table first and change the DHCP server pool size to the amount of static DHCP table. This should allow the DHCP server won't provide IP address to non-authorized device.
2. Enable IP spoofing prevention. Remember the "Include DHCP Leasing Entries" also need to be selected/enabled. (Prevent to connect to the firewall and Internet)
3. Enable ARP Spoofing Prevention in system > advanced setting. (Prevent LAN forwarding traffic)

Hope this helps.

Maverick87

Hi @Zyxel_Melen,
but is not possible to implement a mac address object (also, if I remember well, I've created already an idea about this) and prevent that the mac address object don't receive the DHCP from the interface?

Thanks

PeterUK

So here the thing it should be possible to make a stateful firewall with everything MAC,IP, Port which is not the same as switch that can do ACL with everything MAC,IP, Port.

So can the USG hardware do with everything MAC,IP, Port as a stateful firewall? Or how about a stateful firewall IP, Port with ACL MAC?