topic Re: Global protect and virtual MAC address in General Topics

Global protect and virtual MAC address

darren_g — Wed, 25 Oct 2017 22:47:05 GMT

HI.

We run global protect for a reasonable number of remote users on our PA3050's without much in the way of issues.

One thing which pops up, though, is that our Virus management server (McAfee) gets hugely confused about which machines are on which IP address.

We've done a little digging, and it apepars to be related to te fact that all machines conencting via global protect appear to get the same virtual MAC address for the tunnel interface - and this reports to the virus server.

Which means, of course, every time someone establishes a new VPN connection the virus server gets a new hostname assigned to the MAC address - which is normally wrong.

Does anyone know if there is any way I can force each new connection on GP to get a unique virtual MAC on the tunnel interface on the local PC?

If so, how? I've had a poke around and I can't seem to find any way to do it.

Thanks

Re: Global protect and virtual MAC address

mgarg — Thu, 26 Oct 2017 07:57:58 GMT

Some from the engineering team should be able to comment on whether all virtual interfaces get same mac address as per design.

As far as configuration is concerned, I don't believe there is a setting which allows you to force unique mac addresses or assign them statically.

Re: Global protect and virtual MAC address

darren_g — Thu, 21 Dec 2017 00:05:11 GMT

@mgarg wrote:
Some from the engineering team should be able to comment on whether all virtual interfaces get same mac address as per design.
As far as configuration is concerned, I don't believe there is a setting which allows you to force unique mac addresses or assign them statically.

That was what I was afraid of.

Thanks anyway.