Eventlog > VPN client connected > Mac address?

[mmzzaq]

We have a MX64 configured with L2TP client VPN.

In MX64 > Network-wide > Eventlog > VPN client connected, you can see when a VPN client connected to the MX64. Amongst other things, you'll see a MAC address in the column "Client". All these addresses start with "03:" in my MX64. What MAC address is this? It's not the MAC address of the remote client computer and also not of the remote client's computer router/modem.

My best guess is that it might belong to the remote client's VPN adapter/WAN miniport but I'm not really sure. I couldn't retrieve the MAC address of the VPN adapter/WAN miniport by trying standard methods on the remote client PC (ipconfig /all, powershell, wmi).

I'm kinda disappointed the eventlog doesn't appear to show the remote client's MAC address and thus making identification of physical remote devices impossible, unless I am overlooking something? Does anyone know what these MAC addresses are?

[PaulMcG]

Could it be some kind of virtual MAC address generated by the MX for it's own routing purposes?  I looked at 2 different client MXs and every VPN client connected had some kind of 03: MAC address.  

[Fohrenburg11]

Any more ideas on this, or is it in fact a virtual MAC address generated by the MX as PaulMcG suggested?

[Rimccart]

Hello,
When the user connects we assign them a MAC address that will start with "03" and then the rest of the MAC is generated from a hash of the username.