MAB traffic uses internal endpoints for retrieving identity. MAB (MAC Authentication Bypass) is an authentication method that grants network access to specific MAC addresses regardless of
802.1X capability or credentials. Cisco ISE uses internal endpoints to store and retrieve MAC address information for MAB authentication.
Dot1X traffic uses a user-defined identity store for retrieving identity. Dot1X is a port-based authentication protocol that uses EAP (Extensible Authentication Protocol) to authenticate clients to a network. Cisco ISE uses a user-defined identity store to retrieve identity information for Dot1X authentication. This identity store can be a RADIUS server, Active Directory, or another type of identity store.
Unmatched traffic is dropped because of the Reject/Reject/Drop action that is configured under Options. By default, Cisco ISE is configured to drop unmatched traffic. This means that any traffic that does not match a known authentication method (e.g., MAB, Dot1X, WebAuth) will be dropped.