Suppose you have two NICs with the same MAC address, but not necessarily the same IP address. What is the least possible separation (in terms of number of switches, routers, different IP subnets etc.) needed that would still allow traffic between the NICs?
8
-
1Welcome to Network Engineering! If this question is not hypothetical, you may have an XY Problem. One can normally change the MAC reported by network cards, or in the case of a bonded setup, configure the upstream network device to handle the configuration.– ti7Commented Jan 31, 2020 at 19:38
-
3The question stems from that I on one ESXi server need to be able to run two virtual machines that needs to have the same MAC address and still be able to communicate with each other. (The actual software on the VMs is hardcoded to only load if the VM has a specific MAC address.) I already found answers how to solve it on ESXi (using a 3rd VM with several NICs as router and connect the other VMs to that one), but I am also interested in the theoretical solution to a hypothetical problem, hence my question here.– LapplandsCohanCommented Jan 31, 2020 at 21:17
-
3If the software is just checking that a VM has a specific MAC and not, say, refusing to communicate over only an interface with that MAC, you could probably add a second virtual NIC, connected to nothing, and assign the magic MAC to that. (Though I can also imagine that the software might look only at the first NIC, so maybe reverse them.)– Reid RankinCommented Feb 1, 2020 at 1:07
-
1@LapplandsCohan If the software has such strict requirements, you may not be allowed to do this.– Thorbjørn Ravn AndersenCommented Feb 2, 2020 at 10:32
-
1I'm familiar with lots of software that uses the MAC address for licensing purposes, but does not require that traffic flow over a specific interface.– RandallCommented Feb 2, 2020 at 14:25
|
Show 3 more comments
3 Answers
Suppose you have two NICs with the same MAC address, but not necessarily the same IP address.
You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable switching/bridging.
What is the least possible separation (in terms of number of switches, routers, different IP subnets etc.) needed that would still allow traffic between the NICs?
The NICs need to be in different L2 segments - at least one router in between. Also, they would have to be in different IP subnets to enable normal routing. For a router to see identical MAC addresses in different subnets is not normally a problem.
The number of switches in between doesn't matter - each broadcast is propagated throughout the broadcast domain (=L2 segment), so each NIC messes up the source-address table for the other on every participating switch. Of course, both NICs could be in different VLANs since those represent separate segments.
[edit] As has been pointed out by Jörg, the "router" above can very well be an L3 switch that is used as a router. Note that the switching/bridging function of an L3 switch can not cope with identical MACs within the same segment either.
[edit2] Also, (see comments, I thought that was pretty obvious) having multiple NICs with identical MACs is a bad thing. Generally, MACs are supposed to be unique (at least within a site's scope) in order to avoid problems that may be hard to diagnose.
If need be (thx Ron!) you need to separate those NICs into their own broadcast domains/L2 segments/ESXi port groups and use a router to enable IP communication between them. Make sure your router or L3 switch is fine with duplicate MACs across its L3 interfaces. Do not replace the router without prior testing. Running that router inside a VM might have its own tribulations.
Disclaimer: I have no experience running something like that in an ESXi environment - since a vSwitch works somewhat differently from a hardware switch - it has considerably more insight - there may be unexpected problems (unless you distribute the VMs to different hosts). In any case, duplicate MACs will likely require the "MAC address changes" option on the port group. They might even require running separate vSwitches in addition to using separate port groups.
-
It may not be 100% clear from your last sentence: while a switch won't work, and there has to be a router in between, that router could of course be the same device as a switch. The sort of switches that are on-topic on this site almost always have at last some L3 capabilities, (Which technically makes them no longer switches, or rather switches plus routers in one device.) Commented Jan 31, 2020 at 12:29
-
@JörgWMittag I was referring to the network function, trying not to complicate the answer too much. By function, an L3 switch in a router role is a router.– Zac67 ♦Commented Jan 31, 2020 at 12:32
-
1The OP was referring to this question on Server Fault.– Ron Maupin ♦Commented Jan 31, 2020 at 16:00
-
1Yes, on Server Fault I asked for a specific solution in ESXi, but I was also very curious to the theoretical answer to a general situation, a question for which this forum seemed more appropriate. Commented Jan 31, 2020 at 21:29
-
1@studog, that is a myth. The OUI is what must be globally unique. Beyuond that, the IEEE lets the OUI owner assign the rest of the MAC address as it sees fit. Many companies that own OUIs will repeat MAC addresses in different parts of the world. For example, Wi-Fi requirements are different in different areas. You cannot use a US Wi-Fi adapter in Europe, or vice versa, so a manufacturer can reuse MAC addresses between those areas, and that saves it from having to buy more OUIs.– Ron Maupin ♦Commented Feb 1, 2020 at 14:56
Zac has put a great answer together. But I wanted to add a simplified answer along the same lines.
Identical MAC, not within a single layer 2/broadcast domain.
There are probably a lot of devices out there with the same MAC address, but because the minimum required separation is at this very low level it doesn't cause issues.
Another consideration to keep in mind, there might be some systems that rely on MAC address for identification/tracking, and for this reason I'd hope to never have this issue within a single area of a corporate network.
Zero separation is possible. TLDR Yes you can do it in plain ehternet where there is no any restriction applied.
If communication between VMs is based on IP protocol there will be no issue. Even if it plain L2 protocol there is no issue also if protocol can differentiate communication node not only by MAC address(for example IP protocol).
Because ARP (address resolution protocol) is based not only on Layer 2 address scheme(MAC address) but additionally on IP address scheme. That is why in local network we can have MIM attack (man in the middle attack) then someboby is mocking not only yours MAC address but IP address also and can intercept all on you local traffic. This type of attack can be mitigate by security policy on ethernet switches say by applying some type of policy on eth-port where there can be only one(Hello Duncan McLeod %) ) unique MAC address per ethernet port possible.
-
1Nice theory - but only if you've got no switching in between.– Zac67 ♦Commented Feb 1, 2020 at 23:17
-
There are NICs that will not send a frame with the same source and destination address, and there are NICs that will simply loop back a frame with the destination address that is the same as the source NIC.– Ron Maupin ♦Commented Feb 1, 2020 at 23:42
-
Even if you do have switch between you can have two nics with identical MAC. Only port policy can prevent two identical MAC on different ports . If you do not have one, nothing is prevent it. serverfault.com/questions/462178/… Commented Feb 3, 2020 at 1:14
-
"Only port policy can prevent two identical MAC on different ports ." A switch MAC address table has only one entry for each MAC address. Having two hosts with the same MAC address causes flapping, and many switches have a problem with that.– Ron Maupin ♦Commented Feb 3, 2020 at 19:13