To expand on
@balaji.bandi answer of yes it will mitigate the attacks: There are a ton of factors that play into the 8021x solution as a whole. Deploying/using different components would result in utilizing 8021x with different approaches. A few components and design considerations would include:
What type of protocol will you use in regard to eap?
Do you wish to authenticate both the user and computer or just one of them?
Will you allow mab as a fall back solution if 8021x process terminates for whatever reason?
What types of devices are in your environment?
What supplicant will you use on your end nodes?
How often do you wish end nodes/users to reauthenticate?
Using eap-tls is some fashion in your 8021x solution is one of the more secure methods. However, this requires you to have the ability to manage your own internal pki or utilize someone else. If you implement mab you can utilize your AAA server to manage L2 endpoint groups. One thing you may consider is configuring anomalous endpoint detection and enforcement if you use ISE. This would aide in identifying mac spoofing attempts. Basically if ISE determines that attributes obtained via probes have changed and a device gets re-profiled (even though it sees same MAC) you can configure CoA to shut port down, reauthenticate host, etc.
I hope this additional information helps you!
