In this article we describe the steps to prevent the gaps that occur when users on the network change their IP addresses.

To prevent the use of a higher-privileged user’s IP, run the following Fortinet firewall commands:

Config system interface
edit internal
set ipmac enable
end

config firewall ipmacbinding setting
set bindthroughfw enable (do not allow undefined MAC addresses on the network)
set bindtofw enable (do not allow network access; allow firewall access)
set undefinedhost allow (do not even allow firewall access)
end

config firewall ipmacbinding table
edit 1
set ip 10.0.1.44
set mac 00:21:63:28:C6:8C
set status enable
To configure ipmacbinding: config system dhcp reserved-address
edit pc_name
set ip 10.0.1.44 set mac 00:22:34:28:C6:8C
set type {regular | ipsec} regular end