7100 : spoof MAC ?

sgw

Yes, I searched via Search function:
Is it possible to spoof the underlying MAC of an interface on a Netgate 7100?

I have a cold standby appliance that should act and look like another Netgate 7100.
One of the WAN-providers filters for that MAC ... and WAN doesn't come online without that.

As the WAN etc already is configured as VLAN etc (factory config) it can't be easily done in the interface section of pfSense.

I assume I have to touch the switch configuration?

I think I did that once some years ago, any definitive HOWTO would make this easier, thanks!

stephenw10

The MAC can be spoofed in the default config by assigning and enabling LAGG0 which is the parent for the WAN and LAN VLANs. You can then spoof the MAC on the LAGG and the VLANs will inherit that:

lagg0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	description: OPT4
	options=4e138bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
	ether 00:11:22:33:44:55
	hwaddr 00:00:00:00:00:00
	inet6 fe80::208:a2ff:fe0e:a593%lagg0 prefixlen 64 scopeid 0x17
	laggproto loadbalance lagghash l2,l3,l4
	laggport: ix2 flags=4<ACTIVE>
	laggport: ix3 flags=4<ACTIVE>
	groups: lagg
	media: Ethernet autoselect
	status: active
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lagg0.4091: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,MEXTPG>
	ether 00:11:22:33:44:55
	inet 192.168.127.1 netmask 0xffffff00 broadcast 192.168.127.255
	inet6 fe80::211:22ff:fe33:4455%lagg0.4091 prefixlen 64 scopeid 0x18
	groups: vlan
	vlan: 4091 vlanproto: 802.1q vlanpcp: 0 parent interface: lagg0
	media: Ethernet autoselect
	status: active
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lagg0.4090: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=4000000<MEXTPG>
	ether 00:11:22:33:44:55
	inet 172.21.16.219 netmask 0xffffff00 broadcast 172.21.16.255
	inet6 fe80::211:22ff:fe33:4455%lagg0.4090 prefixlen 64 scopeid 0x19
	groups: vlan
	vlan: 4090 vlanproto: 802.1q vlanpcp: 0 parent interface: lagg0
	media: Ethernet autoselect
	status: active
	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>

You will need to reboot or recreate the LAGG to see that change.

So no need to do anything with the switch if that is sufficient.

sgw

@stephenw10 Ah, I see.
On the first appliance (which runs right now) I can see there is that LAGG0 already.
As I haven't created it myself it was also already rebooted ;-)

But there is no field for assigning a MAC in the GUI.

Recreating sounds dangerous: wouldn't I lose connectivity then? I very likely have to do that from remote, so I'd need a safe procedure.

Bonus question: the resulting config would also work unchanged on the appliance with "physical MAC = spoofed MAC" ?

thanks!

stephenw10

Hmm, so there is no LAGG interface on the standby device?

lagg0 is in the default config for the 7100. It can be removed to create other configs, multiple WAN MACs for example.
It is not assigned as an interface by default though and you need to do that to get the MAC spoof field.

But, yes, adding or removing that means re-configuring the switch and it's VERY easy to loose connectivity if that's how you are connected.

sgw

@stephenw10 said in 7100 : spoof MAC ?:

Hmm, so there is no LAGG interface on the standby device?

That one is offline right now. It's the same config as the online device ->

lagg0 is in the default config for the 7100. It can be removed to create other configs, multiple WAN MACs for example.
It is not assigned as an interface by default though and you need to do that to get the MAC spoof field.

But, yes, adding or removing that means re-configuring the switch and it's VERY easy to loose connectivity if that's how you are connected.

It is visible as "Available network port", but not yet assigned on the active device (in interfaces_assign.php).

I won't try that now, I could try it on the 2nd device in a maintenance window (plus the spoofing part).

I wouldn't remove the Interface LAGG0, I would only add an "Interface Assignment" to then be able to spoof the MAC there. Right?

I think I know my way, I have to make that appointment with the local admin guy first.

thanks

stephenw10

Yes exactly, you need to assign lagg0 as an interface so you can set it's properties in the gui. Then enable the assigned interface and set the MAC there. No need to set anything else on the interface.

Screenshot from 2026-05-19 15-04-10.png

sgw

@stephenw10 great, thanks.
We maybe try that in about 1.5 hours from now.

sgw

Hmm.
The spoofing worked. I assigned etc then we had to powercycle the box to get it online again.

After that the displayed MAC was the spoofed one. Looked OK.

BUT the fiber-router (or whatever that is) didn't "see" the pfSense interface connected.
We had the admin of the provider on the phone, he ran diagnostics, we rebooted and replugged that router without getting it online.

We had electrical link, but he didn't see the MAC arp-wise (I assume).

Plugging back to the original appliance (without spoofing) worked immediately.

The provider-admin asks upstream .. he is only the tech for the reseller, or so.

I wonder: could the fact that it's a LAGG be a problem? I think of stuff like LACP, STP or whatever is different from a plain access interface.

I am just wondering what's the difference from the view of that fiber-box.

I'll keep you posted. Maybe I hear something tomorrow.

stephenw10

The spoofed MAC definitely shows up for me. The upstream router shows it in its ARP table or a pcap.

The LAGG and VLAN shouldn't make any difference. None of that layer 2 stuff exists beyond the switch.

sgw

@stephenw10

You talk of the internal switch?
There is no switch between the 7100 and the fiber-appliance.

Thanks for clarifying. It was just a wild guess while I was listing the possible differences between plugging in the 2 7100-appliances.

stephenw10

Yes the internal switch. The upstream devices shouldn't see any of the LAGG or VLAN specific packets.

sgw

@stephenw10 thank you. Even more of a mystery.
I am curious what the upstream support replies.
I don't expect much ...

stephenw10

Really the only significant difference would be the overhead the tagging adds meaning the path MTU might be slightly lower. But that would be identical between the two 7100s. And it wouldn't prevent connecting entirely.

sgw

I have a theory ... we might test that on friday or tuesday.

Maybe on appliance 2 the assigned order of the interfaces got mixed up?

I am not 100% sure if that is possible, the config.xml was restored so that should be identical.

What I think of: the local admin plugs the cable for WAN2 into ETH2 on App1 and things work (I just make up an example).

So we'd assume ETH2 on Appliance2 should also be assigned to WAN2 (and use its configured static IP etc). The admin just plugs the cable FROM App1:ETH2 TO App2:ETH2 ...

If that's not the case and for some reason WAN2 points to ETH3 on Appliance2 (because of whatever ... timings at bootup?) this would result in the logged behavior: ETH2 plugged in would show the spoofed MAC, but no configured IP.

The theory maybe lacks a bit .. but could that be the case?

stephenw10

What might be happening is the switch config is different. That doesn't get synced so it's possible you have the VLAN assigned to a different port on the secondary node. It's unlikely though if you restored a config onto the secondary from the primary when creating it.
But it's easy enough to compare the switch config on each node.

sgw

@stephenw10

Yes, the internal switch config on Appliance was missing the configs for the additional WAN-interfaces.

The MAC-spoofing might not be needed at all, a test with a random laptop came online on that upstream fiber gateway without problems (with some random MAC).

Now with the correct VLANs etc on the internal switch the plugging works perfectly (we can plug between the 2 appliances and connectivity is up immediately).

thanks!

stephenw10

Nice. Good result!

sgw

@stephenw10 said in 7100 : spoof MAC ?:

Nice. Good result!

It's an honor to hear this from you, thanks ;-)