diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 09f0c00c3..46a386491 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -1927,17 +1927,22 @@ find_device_for_connection (NmCli *nmc,
 
 			if (iface) {
 				const char *dev_iface = nm_device_get_iface (dev);
-				if (   !g_strcmp0 (dev_iface, iface)
-				    && nm_device_connection_compatible (dev, connection, NULL)) {
-					found_device = dev;
+				if (!nm_streq0 (dev_iface, iface))
+					continue;
+
+				if (!nm_device_connection_compatible (dev, connection, error)) {
+					g_prefix_error (error, _("device '%s' not compatible with connection '%s':"),
+					                iface, nm_setting_connection_get_id (s_con));
+					return FALSE;
 				}
+
 			} else {
-				if (nm_device_connection_compatible (dev, connection, NULL)) {
-					found_device = dev;
-				}
+				if (!nm_device_connection_compatible (dev, connection, NULL))
+					continue;
 			}
 
-			if (found_device && ap && !strcmp (con_type, NM_SETTING_WIRELESS_SETTING_NAME) && NM_IS_DEVICE_WIFI (dev)) {
+			found_device = dev;
+			if (ap && !strcmp (con_type, NM_SETTING_WIRELESS_SETTING_NAME) && NM_IS_DEVICE_WIFI (dev)) {
 				char *bssid_up = g_ascii_strup (ap, -1);
 				const GPtrArray *aps = nm_device_wifi_get_access_points (NM_DEVICE_WIFI (dev));
 				found_device = NULL;  /* Mark as not found; set to the device again later, only if AP matches */
diff --git a/libnm/nm-device-ethernet.c b/libnm/nm-device-ethernet.c
index 88a7c4324..825ed7b39 100644
--- a/libnm/nm-device-ethernet.c
+++ b/libnm/nm-device-ethernet.c
@@ -227,9 +227,14 @@ connection_compatible (NMDevice *device, NMConnection *connection, GError **erro
 		perm_addr = nm_device_ethernet_get_permanent_hw_address (NM_DEVICE_ETHERNET (device));
 		s_mac = nm_setting_wired_get_mac_address (s_wired);
 		if (perm_addr) {
+			/* Virtual devices will have empty permanent addr but they should not be excluded
+			 * from the MAC address check specified in the connection */
+			if (*perm_addr == 0)
+				perm_addr = nm_device_ethernet_get_hw_address (NM_DEVICE_ETHERNET (device));
+
 			if (!nm_utils_hwaddr_valid (perm_addr, ETH_ALEN)) {
-				g_set_error_literal (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
-				                     _("Invalid device MAC address."));
+				g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
+				                     _("Invalid device MAC address %s."), perm_addr);
 				return FALSE;
 			}
 			if (try_mac && s_mac && !nm_utils_hwaddr_matches (s_mac, -1, perm_addr, -1)) {
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index 6efa4d99b..90d472da3 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -407,7 +407,7 @@ check_connection_compatible (NMDevice *device, NMConnection *connection)
 		if (!match_subchans (self, s_wired, &try_mac))
 			return FALSE;
 
-		perm_hw_addr = nm_device_get_permanent_hw_address (device, FALSE);
+		perm_hw_addr = nm_device_get_permanent_hw_address (device, TRUE);
 		mac = nm_setting_wired_get_mac_address (s_wired);
 		if (perm_hw_addr) {
 			if (try_mac && mac && !nm_utils_hwaddr_matches (mac, -1, perm_hw_addr, -1))
@@ -1421,7 +1421,7 @@ new_default_connection (NMDevice *self)
 	if (nm_config_get_no_auto_default_for_device (nm_config_get (), self))
 		return NULL;
 
-	perm_hw_addr = nm_device_get_permanent_hw_address (self, FALSE);
+	perm_hw_addr = nm_device_get_permanent_hw_address (self, TRUE);
 	if (!perm_hw_addr)
 		return NULL;