Hi - we're all working remotely now - so I've connected GlobalProtect to reach resources on our domain. I was a little confused when I ran a ping scan on a particular subnet and all the devices returned the same MAC address along with the IP address, 02:50:41:00:00:02. I did a bit of research and learned that the GlobalProtect virtual ethernet adapter has the MAC 02:50:41:00:00:01, so I thought I was getting a little understanding of what I'm seeing - but I guess I didn't expect this behavior, to see all devices returning the same MAC that's just one digit different than my PANGP adapter. It happened with devices on two different subnets. Should I expect that this is what I'll always get when I do ping scans over the VPN? I can get the info I'm looking for by looking at the ARP cache on the various switches, but was curious about this....
are seeing this two. ForeScout is detecting the same MAC on laptops in the office on the local LANs. This is triggering lock downs for MAC Spoofing. But I see no justification to see the Virtual Adaper to send packets out the LAN interface and not use the LAN interface's MAC. I see no one replied to your post. Did you get any answer elsewhere?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!