Overview of Across-Layer-3 MAC Identification

Definition and Objective

With Across-Layer-3 MAC address identification, when a Layer-3 network device is between the FW and intranet PCs, the FW can still learn the MAC address of the intranet PCs.

If an intranet PC uses a dynamic IP address to access the Internet, IP address cannot be used to match the traffic to or from the PC. In this case, you need to use the MAC address as the matching condition of policies.

However, in the across-layer-3 networking as shown in Figure 1 and Figure 2, the FW cannot directly obtain MAC addresses of intranet PCs. You must enable across-Layer-3 MAC address identification on the FW.

The FW across-Layer-3 MAC address identification supports the following two networking scenarios:

Figure 1 FW connected to the Layer-3 network device as a Layer-3 device

Figure 2 FW connected to the Layer-3 network device as a Layer-2 device

Service Flow

Figure 3 shows the service flow of across-Layer-3 MAC address identification on the FW.

Figure 3 Service flow of across-Layer-3 MAC address identification

1. Phase 1

   1. The SNMP agent on the Layer-3 network device is enabled, and the network device obtains IP-MAC mapping of intranet PCs and generate or update ARP entries.
   2. The FW periodically sends SNMP requests to the specified Layer-3 network device for ARP entries.
   3. The Layer-3 network device replies and returns the ARP entries.
   4. The FW learns MAC addresses of intranet PCs and saves the ARP entries to the memory.

2. Phase 2

   An administrator can use the learned MAC addresses on the FW as conditions in policies.

   The MAC addresses are obtained from ARP entries in the memory, not from packet header.

3. Phase 3

   1. An intranet PC accesses the Internet through the Layer-3 network device and FW.

   2. The FW permits or blocks intranet packets based on configured policies.

      After receiving intranet PC packets, the FW compares the IP and MAC address of the PC with the obtained ARP entries to verify whether the MAC address is the real MAC address. The FW uses the actual MAC address to match policies and process intranet packets based on matching results.