Fortinet black logo

Administration Guide

Use MAC addresses in SD-WAN rules and policy routes

Use MAC addresses in SD-WAN rules and policy routes

You can use MAC addresses as the source in SD-WAN rules and policy routes.

The FABRIC_DEVICE address object (a dynamic object that includes the IPs of Security Fabric devices) can be used as a source or destination in SD-WAN rules and policy routes.

The diagnose ip proute match command accepts either the IP or MAC address format for the source:

diagnose ip proute match <destination> <source> <interface> <protocol> <port>

To configure a MAC address as a source for SD-WAN and a policy route:
  1. Configure the MAC address:
    config firewall address
        edit "mac-add"
            set type mac
            set start-mac 70:4c:a5:86:de:56
            set end-mac 70:4c:a5:86:de:56
        next
    end
  2. Configure the policy route:
    config router policy
        edit 3
            set srcaddr "mac-add"
            set gateway 15.1.1.34
            set output-device ha
        next
    end
  3. Configure the SD-WAN rule:
    config system sdwan
        config service
            edit 1
                set dst "all"
                set src "mac-add"
                set priority-members 1
            next
            edit 2
                set dst "FABRIC_DEVICE"
                set priority-members 2
            next
        end
    end
To verify the policy route matching for a MAC address:
# diagnose ip proute match 3.1.1.34 70:4c:a5:86:de:56 port3 22 6
dst=3.1.1.34 src=0.0.0.0 smac=70:4c:a5:86:de:56 iif=11 protocol=22 dport=6
id=00000003 type=Policy Route
seq-num=3

Use MAC addresses in SD-WAN rules and policy routes

You can use MAC addresses as the source in SD-WAN rules and policy routes.

The FABRIC_DEVICE address object (a dynamic object that includes the IPs of Security Fabric devices) can be used as a source or destination in SD-WAN rules and policy routes.

The diagnose ip proute match command accepts either the IP or MAC address format for the source:

diagnose ip proute match <destination> <source> <interface> <protocol> <port>

To configure a MAC address as a source for SD-WAN and a policy route:
  1. Configure the MAC address:
    config firewall address
        edit "mac-add"
            set type mac
            set start-mac 70:4c:a5:86:de:56
            set end-mac 70:4c:a5:86:de:56
        next
    end
  2. Configure the policy route:
    config router policy
        edit 3
            set srcaddr "mac-add"
            set gateway 15.1.1.34
            set output-device ha
        next
    end
  3. Configure the SD-WAN rule:
    config system sdwan
        config service
            edit 1
                set dst "all"
                set src "mac-add"
                set priority-members 1
            next
            edit 2
                set dst "FABRIC_DEVICE"
                set priority-members 2
            next
        end
    end
To verify the policy route matching for a MAC address:
# diagnose ip proute match 3.1.1.34 70:4c:a5:86:de:56 port3 22 6
dst=3.1.1.34 src=0.0.0.0 smac=70:4c:a5:86:de:56 iif=11 protocol=22 dport=6
id=00000003 type=Policy Route
seq-num=3