Creating an alert for MAC spoofing on Mobile Access

[kamilazat]

Hi!

I can see MAC address information of the connected devices in the Mobile Access logs. Is it possible to create a rule for MAC spoofing?

For example, let's say that I receive the log in the picture. I can retrieve the device information, IP, MAC, protocol etc. and want to make sure I'll receive an alert if the same device tried to connect with a different MAC address.

Note: This post is meant to be an extension to the other post I created earlier. 

[Chris_Atkinson]

Can you please share more about your specific remote access & office mode configurations?

Perhaps you want to look at Machine Authentication depending on the specific VPN client used, note version E86.20 is not recent with E87.70 being the latest.

Refer also: https://community.checkpoint.com/t5/Remote-Access-VPN/Office-Mode-Algorithm-behind-quot-Unique-per-m... 

sk104012 - VPN Clients running on Mac OS X that receive an Office Mode IP address from a DHCP Server...