Ping scan returning what looks like a PANGP MAC address

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Ping scan returning what looks like a PANGP MAC address

L0 Member

Hi - we're all working remotely now - so I've connected GlobalProtect to reach resources on our domain. I was a little confused when I ran a ping scan on a particular subnet and all the devices returned the same MAC address along with the IP address, 02:50:41:00:00:02. I did a bit of research and learned that the GlobalProtect virtual ethernet adapter has the MAC 02:50:41:00:00:01, so I thought I was getting a little understanding of what I'm seeing - but I guess I didn't expect this behavior, to see all devices returning the same MAC that's just one digit different than my PANGP adapter. It happened with devices on two different subnets. Should I expect that this is what I'll always get when I do ping scans over the VPN? I can get the info I'm looking for by looking at the ARP cache on the various switches, but was curious about this....

 

Thanks.

2 REPLIES 2

L2 Linker

are seeing this two. ForeScout is detecting the same MAC on laptops in the office on the local LANs. This is triggering lock downs for MAC Spoofing. But I see no justification to see the Virtual Adaper to send packets out the LAN interface and not use the LAN interface's MAC.  I see no one replied to your post.   Did you get any answer elsewhere?

L2 Linker

We see this as well.  Found a random IP address with that MAC address on our network that nobody knew about.  The IP isnt one that we've ever assigned (or would have chosen to assign).  Can't find that IP in the FW itself.  Any ideas?  

  • 3452 Views
  • 2 replies
  • 2 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!