On Mon, Jan 5, 2015 at 1:16 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:

On 05/01/15 12:24, Nick Lowe wrote:

Do these switches or APs not use a Service-Type of Call-Check when
performing MAC auth then? I would be barking at the vendor if that was
missing.

No, they do not.

As for barking at the vendor, in my experience you might as well bark at the moon for all the good it will do. I've wasted enough time with vendors over the last 15 years - they speak money only, I've never once succeeded in getting them to correct a design mis-step on technical grounds.

I pointed out to Aerohive that they were missing the Service-Type AVP on all but 802.1X authentication. It got fixed in a subsequent software release.

While using an EAP type is rather pointless for MAC address
authentication, there isn't an intrinsic problem doing so. I don't think
it's idiotic.

It's been a while since I looked, but doesn't it incur another round-trip?

Yes, you're right, but I think it's subjective if that pushes it in to idiotic territory - I normally reserve that classification for more serious things.
I don't think that will tangibly negatively affect many environments.

Nick