For internal users who adopt MAC binding or MAC-based authentication methods in a cross‑Layer‑3 environment, the Obtain MAC By SNMP feature needs to be enabled to obtain the users' MAC addresses. This feature requires that the internal switches support SNMP. SNMP is a protocol used for network management. Devices expose their ARP tables, MAC address tables, and interface status through SNMP. Athena NGFW queries the ARP table of the Layer 3 switch through SNMP to obtain the IP-to-MAC address mappings.

Principle:

The Athena NGFW firewall periodically obtains the ARP table (IP-to-MAC address mappings) from the Layer 3 switch through the SNMP protocol. When user data packets pass through the firewall, the firewall determines whether the traffic is cross-layer by detecting the source MAC address of the packets. If the MAC address matches that of the Layer 3 switch, the firewall looks up the corresponding real MAC address from the ARP table based on the source IP address of the packet, enabling user MAC identification across Layer 3 devices.

Scenario description:

A company deploys an Athena NGFW firewall at the public network egress to proxy internal users' Internet access. The internal network environment is complex, with Layer 3 switching devices between the users and the firewall. The security department requires MAC binding authentication for internal users. However, due to the presence of Layer 3 devices, the firewall cannot directly obtain the users' real MAC addresses. It needs to obtain the ARP table from the Layer 3 switch through the SNMP protocol to achieve MAC recognition.

Objective:

In a cross‑Layer‑3 network environment, configure the Obtain MAC By SNMP feature of the Athena NGFW firewall to obtain users' real MAC addresses from the Layer 3 switch, achieving user authentication and binding based on MAC addresses.

Topology:

topology_mac.drawio

Prerequisites:

The internal Layer 3 switch supports SNMP, and SNMP is enabled with the community string set to public. A community is the authentication password for SNMP, serving as an access credential. public is the default read-only community name for SNMP v1/v2. Athena NGFW requires only the read permission on the ARP table, and the write permission is not required.

Configuration steps:

Step 1. Enable the Obtain MAC By SNMP feature on Athena NGFW.

Go to System > General Settings > Obtain MAC By SNMP and select Enable SNMP Settings.

Step 2. Configure the following parameters:

SNMP Server Access Timeout (secs): The default value is 3.

SNMP Server Access Interval (secs): The default value is 5.

Parameter	Default Value	Description
SNMP Server Access Timeout (secs)	3	The maximum waiting time for a single SNMP request. If no response is received within this time, the request is considered failed. Value range: 1–10.
SNMP Server Access Interval (secs)	5	The time interval between two SNMP requests, that is, the interval for periodic queries. Value range: 5–300.

Step 3. Add an SNMP server.

Click Add Server.

Enter the IP address of the Layer 3 switch.

Click Search, and select the server found.

Click Save to complete the SNMP server configuration.

Click Save to complete the Layer 3 MAC recognition configuration.

Step 4. Select Enable user authentication and select the authentication zone.

Step 5. Configure the authentication policy.

Go to User Authentication > Authentication Policy, and click Add.

Configure the authentication policy: Specify the applicable IP/MAC address range in the IP/MAC Address field.

In the Authentication Method section, select None/SSO and Take host name as username.

Select Bind IP/MAC and Bind the MAC address on initial login.

Select Added to specified local group.

Step 6. Click OK to view the authentication policy.

Result verification:

After a user completes authentication in a cross-Layer 3 network environment, their online status can be viewed under Authentication > Authentication Status. The username displayed is the computer name, and the Authentication Method is shown as None.

Go to User Management > Local Users, and you can view the new user under the internal user group.

The user's MAC address displayed is the real MAC address (obtained through SNMP from the Layer 3 switch), not the MAC address of the Layer 3 switch.

{{ $t('index.defaultHeader.logo') }}

Athena NGFW (Next-Generation Firewall)

Case: Obtain Real MAC Addresses Through SNMP for Internet Access Authentication