Ping scan returning what looks like a PANGP MAC address

[jkoelker]

Hi - we're all working remotely now - so I've connected GlobalProtect to reach resources on our domain. I was a little confused when I ran a ping scan on a particular subnet and all the devices returned the same MAC address along with the IP address, 02:50:41:00:00:02. I did a bit of research and learned that the GlobalProtect virtual ethernet adapter has the MAC 02:50:41:00:00:01, so I thought I was getting a little understanding of what I'm seeing - but I guess I didn't expect this behavior, to see all devices returning the same MAC that's just one digit different than my PANGP adapter. It happened with devices on two different subnets. Should I expect that this is what I'll always get when I do ping scans over the VPN? I can get the info I'm looking for by looking at the ARP cache on the various switches, but was curious about this....

Thanks.

[Royalfr]

are seeing this two. ForeScout is detecting the same MAC on laptops in the office on the local LANs. This is triggering lock downs for MAC Spoofing. But I see no justification to see the Virtual Adaper to send packets out the LAN interface and not use the LAN interface's MAC.  I see no one replied to your post.   Did you get any answer elsewhere?

[jrauman]

We see this as well.  Found a random IP address with that MAC address on our network that nobody knew about.  The IP isnt one that we've ever assigned (or would have chosen to assign).  Can't find that IP in the FW itself.  Any ideas?