I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2.

Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it's connecting to the right printer, as well as an IP Address to initially make that connection.

I'm going to reference the two networks as the printer network and spooler network.

Pinging the IP Address to the printer from inside the spooler network works fine. We can even configure the printer via the Web interface.

However, the spooler application fails every time we try to send a print job to it. When we run a IP Scan the spooler Mikrotik router cannot seem to return the MAC address of the device, however when inside the printer network, the MAC address returns fine.

Is there a reason why the VPN cannot return the MAC address of the printer? It seems kind why this isn't working when HTTP/S works smoothly and quickly.

1 Answer 1


MAC addresses are only seen or relevant on the local network. Routers strip off the layer-2 frames, losing the original MAC addresses, in order to route the packets. Routers will then build new frames for the next interface, and the next interface may be using a layer-2 protocol that does not have MAC addressing. The final network will have frames for that network, and the source MAC address on the frames from outside the network will be the MAC address of the local router.

In any case, you should never use addressing for security because it is very easy to spoof things like MAC addresses.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    Mar 30, 2019 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.