When the tap driver is loaded and the user selects the optional "mac=fixed"
setting, the tap driver incorrectly uses a globally unique EUI-48 identifier
(as documented in RFC 7042).  Since this is a locally generated ID, the Local
bit in the MAC address should be set to 1.

The following change is suggested:

diff --git a/doc/guides/nics/tap.rst b/doc/guides/nics/tap.rst
index 2f7417bddd..07df0d35a2 100644
--- a/doc/guides/nics/tap.rst
+++ b/doc/guides/nics/tap.rst
@@ -34,14 +34,14 @@ Using the option ``mac=fixed`` you can create a fixed known
MAC address::

 The MAC address will have a fixed value with the last octet incrementing by
one
 for each interface string containing ``mac=fixed``. The MAC address is
formatted
-as 00:'d':'t':'a':'p':[00-FF]. Convert the characters to hex and you get the
-actual MAC address: ``00:64:74:61:70:[00-FF]``.
+as 02:'d':'t':'a':'p':[00-FF]. Convert the characters to hex and you get the
+actual MAC address: ``02:64:74:61:70:[00-FF]``.

-   --vdev=net_tap0,mac="00:64:74:61:70:11"
+   --vdev=net_tap0,mac="02:64:74:61:70:11"

 The MAC address will have a user value passed as string. The MAC address is in
 format with delimiter ``:``. The string is byte converted to hex and you get
-the actual MAC address: ``00:64:74:61:70:11``.
+the actual MAC address: ``02:64:74:61:70:11``.

 It is possible to specify a remote netdevice to capture packets from by adding
 ``remote=foo1``, for example::
diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 8c50801fd4..02f8066635 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -2280,8 +2280,8 @@ set_mac_type(const char *key __rte_unused,
        if (!strncasecmp(ETH_TAP_MAC_FIXED, value, strlen(ETH_TAP_MAC_FIXED)))
{
                static int iface_idx;

-               /* fixed mac = 00:64:74:61:70:<iface_idx> */
-               memcpy((char *)user_mac->addr_bytes, "\0dtap",
+               /* fixed mac = 02:64:74:61:70:<iface_idx> */
+               memcpy((char *)user_mac->addr_bytes, "\002dtap",
                        RTE_ETHER_ADDR_LEN);
                user_mac->addr_bytes[RTE_ETHER_ADDR_LEN - 1] =
                        iface_idx++ + '0';
diff --git a/examples/ipsec-secgw/test/common_defs.sh
b/examples/ipsec-secgw/test/common_defs.sh
index 3ef06bc761..6e04ffc1a6 100644
--- a/examples/ipsec-secgw/test/common_defs.sh
+++ b/examples/ipsec-secgw/test/common_defs.sh
@@ -26,7 +26,7 @@ fi

 LOCAL_IFACE=dtap0

-LOCAL_MAC="00:64:74:61:70:30"
+LOCAL_MAC="02:64:74:61:70:30"

 REMOTE_IPV4=192.168.31.14
 LOCAL_IPV4=192.168.31.92