MAB ==> For Wired Client only ==> If dot1x authentication fails, then Mac authentication is tried.
MAC Authentication Failover to 802.1X ==> If mac authentication fails, then try dot1x authentication.
1. Is there not any MAB equivalent in wireless, wherein if dot1x authentication fails for wireless clients than MAB is tried?
2. If we enable mac authentication on a WLAN, will it consume any end point license from ISE?
MAB and dot1.x can't be configure on the same SSID.
Please check the doc for IPSK Deployment Cisco WLC and ISE
Yes, That can be done.
You have to configure the SSID with WPA2+PSK and MAC filtering , In the AAA server you have to map the radius server which you want to use for MAB.