Reauthentication of MAB devices at the end of reauth timer

[cpaquet]

How does the reauthentication works for a MAB devices, once the intf reaches the end of the reauth timer, let's say, after 180min?

With 1X, the switch will send EAPoL request to the endpoint.  But how does the switch proceed for a MAB device?  In an IoT environment, one of my customer says that its devices can stay silent for hours.  So, how would the switch port know if the device is still there?

Thanks.

[Colby LeMaire · Accepted solution]

For MAB, authentication requests are sent using whatever MAC address the switched learned on that particular interface.  If the link state stays up and the reauth timer expires, the switch will reauthenticate the device using the MAC address it already knows for the device.  If the device goes to sleep and the link state goes down, then the session expires and a new authentication process will happen when the device wakes up as a totally new session.  If the link state stays up and the device is silent long enough for the switch to age out the MAC address, then no authentication request will be sent until the device attempts to communicate again and the switch learns the MAC again.

[cpaquet]

Great explanations.  Make sense.  Thanks Colby.