On ports configured for 802.1X with MAB as the fallback method, a switch sends a RADIUS Access-Request after a device ignores its EAPOL identity requests, and ISE must decide access from what the switch places in that request. Which identity does ISE evaluate to authorize the device?
Select an answer to reveal the explanation.
Short Explanation
When MAB kicks in, you can think of the switch as a receptionist passing along the device’s MAC address so ISE can match it to an endpoint record. The device didn’t provide an EAP identity response.
Full Explanation
MAB is identification rather than authentication: the switch sends EAPOL identity requests, hears nothing back, then falls through its method list and builds a RADIUS Access-Request whose attributes include the device's MAC address as its MAB identity. ISE can use that identity to look up the endpoint record and apply authorization policy. An EAP identity response describes a supplicant that answered the switch, and a device that ignored EAPOL does not produce one, so that path cannot identify it here. DHCP fingerprinting is a profiling method that uses probe data; it is not the identity presented in the MAB request. An IP address may appear in other network data, but it is not the MAC-based identity used for MAB. Exam caveat: MAB provides limited assurance because MAC addresses can be spoofed or randomized, so treat these endpoints as low trust. Practical check: connect a device and confirm the session details show the MAB method and expected identity.