802.1X authentication ? (WPA2-RADIUS) If so , system is authenticated by user/pass and/or a certificate and the client and AP have a unique encryption key.. no other device can just come along with the same MAC and just start using the network. For WPA2 PSK, another client would need to know the shared key to authenticate and associate with the AP. you could have MAC control ...and so if the attacker knows the PSK then yes, they could get online by spoofing the MAC of an allowed client alan