Fortinet FortiGate 50A User Manual download pdf (Page 164)

164 Fortinet Inc.

IP/MAC binding Firewall configuration

4 Select New to add IP/MAC binding pairs to the IP/MAC binding list.

All packets that would normally be allowed through the firewall by a firewall policy are

first compared with the entries in the IP/MAC binding list. If a match is found, then the

firewall attempts to match the packet with a policy.

For example, if the IP/MAC pair IP 1.1.1.1 and 12:34:56:78:90:ab:cd is added to the

IP/MAC binding list:

• A packet with IP address 1.1.1.1 and MAC address 12:34:56:78:90:ab:cd is

allowed to go on to be matched with a firewall policy.

• A packet with IP 1.1.1.1 but with a different MAC address is dropped immediately

to prevent IP spoofing.

• A packet with a different IP address but with a MAC address of

12:34:56:78:90:ab:cd is dropped immediately to prevent IP spoofing.

• A packet with both the IP address and MAC address not defined in the IP/MAC

binding table:

• is allowed to go on to be matched with a firewall policy if IP/MAC binding is set

to Allow traffic,

• is blocked if IP/MAC binding is set to Block traffic.

Configuring IP/MAC binding for packets going to the firewall

Use the following procedure to use IP/MAC binding to filter packets that would

normally connect with the firewall (for example, when an administrator is connecting to

the FortiGate unit for management).

To configure IP/MAC binding for packets going to the firewall

1 Go to Firewall > IP/MAC Binding > Setting.

2 Select the Enable IP/MAC binding going to the firewall check box.

3 Go to Firewall > IP/MAC Binding > Static IP/MAC.

4 Select New to add IP/MAC binding pairs to the IP/MAC binding list.

All packets that would normally connect to the firewall are first compared with the

entries in the IP/MAC binding table.

For example, if the IP/MAC pair IP 1.1.1.1 and 12:34:56:78:90:ab:cd is added to the

IP/MAC binding list:

• A packet with IP address 1.1.1.1 and MAC address 12:34:56:78:90:ab:cd is

allowed to connect to the firewall.

• A packet with IP 1.1.1.1 but with a different MAC address is dropped immediately

to prevent IP spoofing.

• A packet with a different IP address but with a MAC address of

12:34:56:78:90:ab:cd is dropped immediately to prevent IP spoofing.

• A packet with both the IP address and MAC address not defined in the IP/MAC

binding table:

• is allowed to connect to the firewall if IP/MAC binding is set to Allow traffic,

• is blocked if IP/MAC binding is set to Block traffic.

1 2 ... 159 160 161 162 163 164 165 166 167 168 169 ... 271 272

No comments

Fortinet FortiGate 50A User Manual Page 164