Oooo I have to try this. The imp office has an 589, and myself & Zandr spent a long time with an edgerouter bypassing it for everything *except* 802.1x.

ie, we forward 802.1x traffic to the 589, turning the AT&T port on, but then all packets go via a pfSense box.