It basically tells ISE to use the end station MAC address as the "password" to connect.
See the following two links for more detail:
https://supportforums.cisco.com/discussion/11495681/process-host-lookup-ise
http://www.ciscopress.com/articles/article.asp?p=2091952&seqNum=3
