In ArubaOS WLAN SSID profiles, the command mac-authentication enables MAC-based authentication on the SSID. When MAC authentication is enabled and l2-auth-failthrough is not configured, the AP treats MAC authentication as the decisive Layer-2 method: if the MAC check does not return an accept, the client is not allowed to proceed to another Layer-2 method (such as 802.1X). Aruba documentation states that l2-auth-failthrough allows a client to fall through to the next Layer-2 authentication method when the first method fails or is not matched.

Therefore, with IoT devices using MAC authentication and non-IoT devices using 802.1X on the same SSID, you must enable l2-auth-failthrough so that clients that do not match MAC authentication are allowed to attempt 802.1X.

mac-authentication: enables MAC-auth on the SSID.

l2-auth-failthrough: permits clients to continue to 802.1X when MAC-auth is not accepted.

Changing opmode (WPA2 vs WPA3) or max-authentication-failures does not resolve the Layer-2 method selection behavior.

Removing mac-authentication would prevent the IoT MAC-auth use case.

References (HPE Aruba Networking official guides):

ArubaOS WLAN SSID Profile—Layer-2 Authentication Methods: mac-authentication and l2-auth-failthrough behavior and sequencing.

Aruba ClearPass and ArubaOS Integration—MAC Authentication with 802.1X coexistence on a single SSID using fail-through.