0

Is there a way to change the MAC address of VLAN interfaces (switched virtual interfaces) on IOS? I would like to configure the MAC address of a Catalyst switch. Because all VLAN interfaces derive their MAC addresses from the base MAC (show version | include Base) and the Switch(config-if)# mac-address command is missing in the context of a VLAN interface, I cannot get the desired configuration.

I'm open to any workaround, no matter how obscure.

5
  • Which model of switch and which IOS version?
    – hertitu
    Oct 6 '16 at 9:29
  • And may I ask why you want to do this (mainly out of curiosity, but there might be a different solution to your actual problem) ?
    – hertitu
    Oct 6 '16 at 9:39
  • Models: Catalyst 3550, IOS 12.2; Catalyst 2960, IOS 12.2. Oct 6 '16 at 10:13
  • Why? It makes tracking a switch easier it has an eye-catching address. That come in handy if I don't have a host available that supports spoofing. In that case an extra VLAN interface does the job. Oct 6 '16 at 10:23
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7 '17 at 15:48
3

A quick google search turns up the doc "Supported Platforms for Unique MAC Address Configuration on VLAN or L3 Interfaces for Catalyst Switches" which learns us that both the default behaviour as well as the potential to change the MAC address, are very different depending on the switch model (and in some cases, depending on the IOS version).

So, look up your model there but I think it is safe to assume that if Switch(config-if)# mac-address does not work, changing the MAC address is not supported on that platform.

Potential workaround

If "standby mac-address" is supported on your platform, you can configure HSRP with a virtual IP address linked to a virtual MAC. In other words if you currently have

interface vlan 2
  ip address 10.0.0.1 255.255.255.0

Then you can change this to e.g. :

interface vlan 2
  ip address 10.0.0.254 255.255.255.0
  standby 1 mac-address 1234.dead.beef
  standby 1 ip 10.0.0.1

Where 10.0.0.254 is a previously unused address. Since I'm not sure of the reason for your request, it may or may not be important to note that an ARP request for 10.0.0.254 will still reveal the switch's BIA (burnt-in address) so if you're doing this e.g. to avoid fingerprinting, it may not be optimal.

4
  • +1. The idea of using a virtual MAC address of an FHRP is great. Oct 6 '16 at 14:56
  • On the Catalyst 3550, the (config-if)# standby 1 mac-address command is not supported. Neither is it on the Catalyst 2960. Oct 6 '16 at 14:56
  • Sorry, then I'm out of ideas :(
    – hertitu
    Oct 6 '16 at 15:11
  • Really, it's a great idea! Oct 6 '16 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.