My customer has complaint about the MAC address authentication, when they physically remove the machine from the network the mac address and ip address still on the "Monitoring > Client", it only disappear when perform the command line "aaa user delete mac xx:xx:xx:xx:xx:xx". But i suspect is the switch of the ARP cache.
Please advise, have any other root cause?