Notification of an unauthorized device in the network (MAC address)

Kamil_Szymanski

Hi, I'm a new SonicWall user. I need to set up e-mail notification, when unauthorized MAC Address appears in the corporate network. Can I ask for help?

My Device: SONICWALL NSA 3700 

Firmware version: 7.0.0.15

BWC

@Kamil_Szymanski I highly recommend a real NAC for detecting/reporting/quarantining unauthorized devices, but you might look into this if it fits your needs:

https://www.sonicwall.com/support/technical-documentation/docs/sonicosx-7-0-0-0-system/Content/MAC_IP_Anti_Spoof/mac-ip-anti-spoof-edit-settings.htm/

E-Mail Notification can be done via logging for the specific events.

--Michael@BWC

MustafaA

Hi @Kamil_Szymanski

Definitely upgrade the firmware since your current firmware is the initial release which is substantially outdated. Firmware 7.0.1-5111 was released on 2023-03-02 and you can download it on MySonicWall.com.

For your requirement, the first step is to restrict the traffic from only selected MAC addresses which is explained in the following KB article.

https://www.sonicwall.com/support/knowledge-base/how-to-restrict-traffic-from-only-selected-mac-addresses-using-mac-ip-anti-spoof-protection/170505994576762/

Second step is to configure the Log Settings for "MAC-IP Anti Spoof" Event Group under Log Settings. Make sure it is enabled for the Alert column.

Third step is to make sure you have the Mail Server Settings and Email Settings under Log Automation. Alert emails are sent whenever there is an Event triggered, which is enabled for the Alert column under the Log Settings. Also, make sure the Logging Level is correct. For more detailed explanation you can check the Admin Guide which is accessible on sonicwall.com/support

Kamil_Szymanski

Hi

I have to restrict the traffic from only selected MAC addresses? I just want to be notified that someone outside the defined MAC list has access.