In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be changed then it won't be unique anymore. Why do we allow this? What's the rationale behind this? Is it legal to change the mac-address? In my opinion, it's a security breach like how will you trace which device has done some wrong thing. Like, it will break the cybersecurity.
If we allow the mac-address to be changed then it won't be unique anymore.
A MAC address is not as unique as you may think. What is supposed to be unique is the OUI assigned by the IEEE to an organization. The organization with the OUI can assign MAC addresses in the OUI as it sees fit. It can make ethernet, Wi-Fi, and token ring NICs, and reuse the same MAC address on each type of network. Some organizations reuse MAC addresses in different parts of the world. A MAC address need only be unique on the LAN to which it is attached.
You can change the MAC address on just about any host with an IEEE protocol NIC. You are supposed to set the U/L bit to show that it is a locally administered MAC address, but many people do not do this. None of the burned-in addresses should have that bit set. There are/have been businesses, that wanted known MAC addresses on a particular host, so they go to the trouble of manually setting the MAC address on the hosts. That can prevent problems with things like replacing NICs in a server or other host, and having software break because of that.
Some of this goes back into history when we used strictly layer-2 networks and software.
There are - well, let's make that used to be - networking protocols and program suites which took great benefit of predictable LAA (as in Locally Administered Adress) at the MAC layer. Those were more prevalent in the days when IPv4 was not quite as ubiquitous as it is today.
One example: I remember setting LAA adresses on Token Ring adapters back in the late 1990ies - the MAC address was used to identify the PC of a given desk or user - much like people still do with IP adresses and fixed DHCP leases. When a PC had to be replaced, we'd configure the Token Ring driver with it the LAA MAC address of the user or desk, so it could be found easily. The main use case was a kind of a remote desktop/support/screen sharing tool (much like teamviewer is today) for OS/2 (sic!) that would work with some L2-protocol.
I'm sure that others will have more LAA related stories to share ;-)