diff --git a/bsp/boards/python/setup.py.in b/bsp/boards/python/setup.py.in
index 9c7354d8d1..f093ef7237 100644
--- a/bsp/boards/python/setup.py.in
+++ b/bsp/boards/python/setup.py.in
@@ -42,6 +42,7 @@ openwsn_module = Extension(
         ('OPENWSN_UDP_C', '${OPENWSN_UDP_C}'),
         ('OPENWSN_ICMPV6ECHO_C', '${OPENWSN_ICMPV6ECHO_C}'),
         ('OPENWSN_6LO_FRAGMENTATION_C', '${OPENWSN_6LO_FRAGMENTATION_C}'),
+        ('OPENWSN_IEEE802154E_SECURITY_C', '${OPENWSN_IEEE802154E_SECURITY_C}'),
 
         # stack configuration
         ('ADAPTIVE_MSF', '${ADAPTIVE_MSF}'),
diff --git a/cmake/options.cmake b/cmake/options.cmake
index 7b2cc35731..9fc3f5713f 100644
--- a/cmake/options.cmake
+++ b/cmake/options.cmake
@@ -76,3 +76,11 @@ if (PRINTF)
 else ()
     set(BOARD_OPENSERIAL_PRINTF "0")
 endif ()
+
+option(L2_SECURITY "Enable link-layer security" OFF)
+if (L2_SECURITY)
+    add_definitions(-DOPENWSN_IEEE802154E_SECURITY_C)
+    set(OPENWSN_IEEE802154E_SECURITY_C "1")
+else ()
+    set(OPENWSN_IEEE802154E_SECURITY_C "0")
+endif()
diff --git a/stack/02a-MAClow/IEEE802154_security.c b/stack/02a-MAClow/IEEE802154_security.c
index 82c5539ec7..2a0e8f5e5d 100755
--- a/stack/02a-MAClow/IEEE802154_security.c
+++ b/stack/02a-MAClow/IEEE802154_security.c
@@ -257,7 +257,7 @@ void IEEE802154_security_retrieveAuxiliarySecurityHeader(QueueEntry_t *msg, ieee
     uint8_t temp8b;
     uint8_t i;
     uint8_t receivedASN[5];
-    macFrameCounter_t l2_frameCounter;
+    asn_t l2_frameCounter;
 
     // retrieve the Security Control field
     // 1byte, Security Control Field
diff --git a/stack/03b-IPv6/forwarding.c b/stack/03b-IPv6/forwarding.c
index 7591019cad..f36d269181 100644
--- a/stack/03b-IPv6/forwarding.c
+++ b/stack/03b-IPv6/forwarding.c
@@ -465,7 +465,7 @@ owerror_t forwarding_send_internal_RoutingTable(
     open_addr_t temp_prefix64btoWrite;
 
     // retrieve the next hop from the routing table
-    if (msg->is_cjoin_response || msg->creator == COMPONENT_CJOIN) {
+    if (packetfunctions_isLinkLocal(&msg->l3_destinationAdd)) {
         if (neighbors_isStableNeighbor(&(msg->l3_destinationAdd)) || msg->is_cjoin_response) {
             // IP destination is 1-hop neighbor, send directly
             packetfunctions_ip128bToMac64b(&(msg->l3_destinationAdd), &temp_prefix64btoWrite,