diff --git a/libnm-core/nm-core-internal.h b/libnm-core/nm-core-internal.h
index 868f731214..1fa8ac5de6 100644
--- a/libnm-core/nm-core-internal.h
+++ b/libnm-core/nm-core-internal.h
@@ -875,4 +875,8 @@ gboolean nm_utils_connection_is_adhoc_wpa (NMConnection *connection);
 
 const char *nm_utils_wifi_freq_to_band (guint32 freq);
 
+/*****************************************************************************/
+
+gboolean _nm_ip_tunnel_mode_is_layer2 (NMIPTunnelMode mode);
+
 #endif
diff --git a/libnm-core/nm-setting-ip-tunnel.c b/libnm-core/nm-setting-ip-tunnel.c
index b4921feaa2..844555f074 100644
--- a/libnm-core/nm-setting-ip-tunnel.c
+++ b/libnm-core/nm-setting-ip-tunnel.c
@@ -305,6 +305,14 @@ nm_setting_ip_tunnel_get_flags (NMSettingIPTunnel *setting)
 
 /*****************************************************************************/
 
+gboolean
+_nm_ip_tunnel_mode_is_layer2 (NMIPTunnelMode mode)
+{
+	return NM_IN_SET (mode,
+	                  NM_IP_TUNNEL_MODE_GRETAP,
+	                  NM_IP_TUNNEL_MODE_IP6GRETAP);
+}
+
 static gboolean
 verify (NMSetting *setting, NMConnection *connection, GError **error)
 {
@@ -458,9 +466,7 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 	}
 
 	if (   nm_connection_get_setting_wired (connection)
-	    && !NM_IN_SET (priv->mode,
-	                   NM_IP_TUNNEL_MODE_GRETAP,
-	                   NM_IP_TUNNEL_MODE_IP6GRETAP)) {
+	    && !_nm_ip_tunnel_mode_is_layer2 (priv->mode)) {
 		g_set_error (error,
 		             NM_CONNECTION_ERROR,
 		             NM_CONNECTION_ERROR_INVALID_PROPERTY,
diff --git a/src/devices/nm-device-ip-tunnel.c b/src/devices/nm-device-ip-tunnel.c
index f070dd5f9e..3ac854623a 100644
--- a/src/devices/nm-device-ip-tunnel.c
+++ b/src/devices/nm-device-ip-tunnel.c
@@ -970,13 +970,16 @@ set_property (GObject *object, guint prop_id,
 static NMActStageReturn
 act_stage1_prepare (NMDevice *device, NMDeviceStateReason *out_failure_reason)
 {
+	NMDeviceIPTunnel *self = NM_DEVICE_IP_TUNNEL (device);
+	NMDeviceIPTunnelPrivate *priv = NM_DEVICE_IP_TUNNEL_GET_PRIVATE (self);
 	NMActStageReturn ret;
 
 	ret = NM_DEVICE_CLASS (nm_device_ip_tunnel_parent_class)->act_stage1_prepare (device, out_failure_reason);
 	if (ret != NM_ACT_STAGE_RETURN_SUCCESS)
 		return ret;
 
-	if (!nm_device_hw_addr_set_cloned (device, nm_device_get_applied_connection (device), FALSE))
+	if (   _nm_ip_tunnel_mode_is_layer2 (priv->mode)
+	    && !nm_device_hw_addr_set_cloned (device, nm_device_get_applied_connection (device), FALSE))
 		return NM_ACT_STAGE_RETURN_FAILURE;
 
 	return NM_ACT_STAGE_RETURN_SUCCESS;