allow access for only the listed mac adresses

The RADIUS server then receives the access-request message and performs MAC authentication. Once the source MAC address is identified, the packet is discarded and the switch creates a RADIUS access-request-message with the MAC address of the machine/user as the identity. The switch initiates MAB first by accepting a single packet from an interface to identify where the endpoint’s MAC address originates from. This step is usually done by the switch and does not involve the RADIUS. It then attempts to use MAB to authenticate it. Three timeouts later, the switch indicates that the endpoint does not have a supplicant. Switch submits an EAPoL identity request and every 30 seconds (by default) a message is sent to the endpoint.

When RADIUS MAC auth Bypass is enabled, MAB takes 3 steps of authentication to provide device/user access. You could also restrict clients to only be able to connect for x days, so neighbors don't find your WiFi to be their backup internet connection.With MAB, the switch uses the MAC address database to verify the user/device identity before granting access. For example, OpenMesh WiFi devices include such functionality which could allow the receptionist at your office to print out 'tokens' for access, which could be unlimited in duration.

If it is a guest network, fully physically or VLAN separated from any production network, with little need for authentication then perhaps a token-based system or captive WiFi portal type system would be useful. These alternatives are easier to maintain going forward however than updating MAC lists every time a device is swapped out. However, from a security perspective, I would consider MAC filtering to be a deprecated practice with superior, albeit more difficult to implement alternatives available. Other than that, it is useful for keeping inventory and identifying computers on the network when NetBIOS name/etc is not available or has been changed to something you don't recognize. So, from your MAC address list, you can determine what DHCP or static address a machine has, which is useful on occasion. For example, one can lookup a given MAC address's IP address on the network using ARP. MAC address lists are often maintained for other reasons.

Instead, 802.1x authentication or something like Cisco's MacSec offers far superior security. I agree that for the reasons you explained, MAC address authentication is not very difficult to bypass - although as schroeder points out, this is difficult on non-rooted phones/tablets.

Allow access for only the listed mac adresses