I've been looking at traffic logs generated by a Pulse Secure appliance (formerly Juniper Pulse Secure) and have noticed that when the appliance generates a MAC Address it prefixes that address with 55:4E which ends up looking like 55:4E:xx:xx:xx:xx.

This is inference based on what I know of my environment, but also have found anecdotal reference of Juniper Pulse Secure utilizing 55:4E in a post from 2014 entitled Who Uses the 55:4e:20 MAC OUI? Further at least according to this OUI list Juniper doesn't have an OUI prefixed with 55:4E (neither does Pulse Secure or anyone else).

From my admittedly limited understanding 55:4E doesn't seem to conform to the "locally administered addresses are distinguished by setting the second-least-significant bit." Which to my mind means that there are four Locally Administered Address Ranges:

  • x2-xx-xx-xx-xx-xx
  • x6-xx-xx-xx-xx-xx
  • xA-xx-xx-xx-xx-xx
  • xE-xx-xx-xx-xx-xx

Which leads me to my questions:

  • Doesn't this practice have the potential for causing major issues in case an OUI starting with 55:4E is purchased in the future?
  • Can the Pulse Secure appliance be configured to use a locally administered address?
  • Is there a standard that makes this practice okay that I've missed?
  • 1
    MAC addressing is handled by the IEEE not the IETF, so there will not be an RFC about that. As for why Pulse Secure is doing that, you will need to ask Pulse Secure. We can only guess or speculate, and that is off-topic here.
    – Ron Maupin
    Dec 18 '19 at 0:02
  • @RonMaupin so is the whole question off topic or is that why you pulled those questions out of the list?
    – ahsteele
    Dec 18 '19 at 0:04
  • 1
    I just removed the off-topic parts. The other three questions there are fine.
    – Ron Maupin
    Dec 18 '19 at 0:05
  • I once ran into two SGI workstations with identical Mac addresses (apparently they calculated their MAC address from the serial number, and the serial number was duplicated due to an RMA). They had problems on the same Ethernet network that were difficult to troubleshoot. But it’s such a low probability event with 32-bits of (hopefully) random Mac addresses. Simply having them on separate vlans restored their connectivity. That said, vendors should only use Mac addresses assigned to them. Dec 18 '19 at 2:46
  • Does it actually use the address in the Ethernet frame, or just some of the higher level layers?
    – richardb
    Dec 18 '19 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.