I have multiple sites, all connected centrally to a corporate office over VPN. I can see the IP addresses of the remote hosts but the MAC gets stripped. Is there a way to configure the network so that the source IP and MAC get passed?

  • 1
    This sounds like a XY-problem. Why do you need those MAC-addresses, what's the problem you're trying to solve? – Teun Vink Mar 25 '17 at 9:39
  • Need the MAC address to persistently identify specific devices for a defined purpose. I know that is kind of vague but I can't get into too many specifics. – Kevin_H Mar 27 '17 at 14:13
  • Using MAC addresses to identify specific devices is a fool's game. It is laughably easy for someone to change a MAC address on a device. Using MAC addresses to identify devices for white or blacklisting will give you a completely false sense of security. – Ron Maupin Mar 27 '17 at 14:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 17 '17 at 5:29

MAC addresses are only significant or seen on the layer-2 LAN where the host connects. Not all layer-2 protocols even use MAC addresses, and some use 48-bit MAC addresses, and some use the newer 64-bit MAC addresses.

Routers operate at layer-3, so they strip the layer-2 frames off the layer-3 packets so they can build new layer-2 frames for the new interface out which the packets will be forwarded.

  • I believe IPV6 would solve the problem but not a workable solution in this case. – Kevin_H Mar 27 '17 at 14:08
  • Why would IPv6 solve the problem, and what, specifically, is the problem in the first place? A MAC address is only useful on the local layer-2 LAN. There is no need or use for it on a different layer-2 LAN. What if the originating LAN uses 48-bit MAC addresses, but the destination LAN uses 64-bit MAC addresses? A MAC address merely serves to deliver frames directly between devices on a layer-2 LAN, and needs to be different on different LANs. – Ron Maupin Mar 27 '17 at 14:19

I have been studying this very concept the past couple weeks and have conducted a few labs consisting of 4+ Cisco routers and 3 Cisco switches. When a client on your network is trying to send a packet to a client at another site, it will send an ARP request to the router since the destination is on a different network (assuming ARP tables arent populated). It will then forward the packet to the router (it's default gateway). The router will have a route set (or default gateway) and it will forward the packet through that route. At this point the L2 frame will be stripped, and the router will re-encapsulate the packet, but the source MAC address will be set to that of the routers WAN MAC address, but it will of course preserve the origin IP so responses can find their way back to the correct client. It will then forward the packet to the next router designated in the routing table. This process will continue until the destination client is reached.

Unless you want to deviate from the standard convention of internet routing protocols and re-program all your networking hardware and clients, I don't think you will be able to get around this.

  • A source host will not ARP for the MAC address of a host on a different layer-3 network. It knows this by comparing its masked layer-3 address with the masked layer-3 address of the destination. If the host is on a different layer-3 network, it will use ARP to get the layer-2 address of its configured gateway, and it will use that on the frame. Also, routers often have WAN links that do not use MAC addresses, e.g. PPP, frame relay, ATM, etc. – Ron Maupin Mar 25 '17 at 2:02
  • @RonMaupin You are correct, I was staring at the captured ARP requests going to the router explicitly and still messed that up in my answer. I will make corrections accordingly. – SuperAdmin Mar 25 '17 at 2:04

You need to use Layer 2 VPN for this to work. Then you can get virtually same LAN across VPN endpoints.

  • That would require MPLS implementation and that is not viable. – Kevin_H Mar 27 '17 at 14:09
  • You have L2 mode in OpenVPN , GRE(Transparent Ethernet Bridging) and I think L2TP/PPTP options as well and not just MPLS. – Alex Levit Mar 27 '17 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.