Our wireless setup is as follows:

Office1:
AP800 with Secure Wireless Network and Open Guest Wireless Network. Both networks go to our main company firewall. (Fortigate 110c)

Office2:
AP700 as wireless repeater that pipes connections to the AP800.

My issue is this...

The main company Fortigate firewall uses MAC filtering to allow/block access to the internet from mobile devices.

However, when mobile devices join the Wireless Repeater in Office2, all connections come from the MAC address of the Draytek AP700, and NOT the Iphone,Android,Ipad MAC address of the actual mobile device itself.

Practically, this means that any staff member can join the repeater network (staff sharing the wireless password etc) and get access to WiFi.

Is there a way to get the Draytek AP700 to transparently pipe the MAC address of the actual mobile device as opposed to the MAC address of the repeater AP700? That way I can still control what devices can use the repeater.

n.b. I would rather not introduce MAC filtering on the Office1 AP OR the Office2 repeater as this fragments the centrally managed network.

Anyone have any ideas on this? Maybe someone from Draytek support team themselves knows whether this is possible/ and alternative?