802.1x PAE about dentos HOT 2 OPEN

Where is watcher solution for MAC Authentication Bypass explained, is there any standard covering it?

from dentos.

Typically the NAS will formulate the authentication request on behalf of the device that does not support 802.1x EAP, for wired the typical implementation leverages RSTP Learning state in order to glean the MAC address, once the MAC address is learned on the port by monitoring the forwarding table an authentication request can be formed using the MAC address as the username and password.

There are silent hosts that do not send any traffic unless they receive a broadcast or other form of traffic first, in this case the problem is the same, however instead of leveraging the learning state, an L2 ACL would need to be used in order to filter all inbound traffic from going beyond the port but allow outbound traffic towards the host in order to "wake it up"

from dentos.