Eventlog > VPN client connected > Mac address?

Here to help

Eventlog > VPN client connected > Mac address?

We have a MX64 configured with L2TP client VPN.


In MX64 > Network-wide > Eventlog > VPN client connected, you can see when a VPN client connected to the MX64. Amongst other things, you'll see a MAC address in the column "Client". All these addresses start with "03:" in my MX64. What MAC address is this? It's not the MAC address of the remote client computer and also not of the remote client's computer router/modem.


My best guess is that it might belong to the remote client's VPN adapter/WAN miniport but I'm not really sure. I couldn't retrieve the MAC address of the VPN adapter/WAN miniport by trying standard methods on the remote client PC (ipconfig /all, powershell, wmi).


I'm kinda disappointed the eventlog doesn't appear to show the remote client's MAC address and thus making identification of physical remote devices impossible, unless I am overlooking something? Does anyone know what these MAC addresses are?

3 Replies 3
Getting noticed

Could it be some kind of virtual MAC address generated by the MX for it's own routing purposes?  I looked at 2 different client MXs and every VPN client connected had some kind of 03: MAC address.  

New here

Any more ideas on this, or is it in fact a virtual MAC address generated by the MX as PaulMcG suggested?

Meraki Employee
Meraki Employee

When the user connects we assign them a MAC address that will start with "03" and then the rest of the MAC is generated from a hash of the username. 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.