Jacob, since multiple questions related to same topic, I am flagging this as a duplicate of MAB with Juniper devices in FIPS mode.
I have not found a definitive reference related to FIPS compliance with MAC Authentication other than typical statements that unencrypted passwords or weak ciphers/hashes such as EAP-MD5, PAP, CHAP, and MSCHAPv1/v2 are explicitly not supported. Even though these protocols are disabled in FIPS mode, the basic host lookup function can still authenticate endpoints based on their MAC address.
Most references state that MAC Auth by its nature is easily spoofed since L2 headers appear in clear, but use of EAP-MD5 or other context does offer better security and a next best choice over simple cleartext. I would check with your security officer for more official statement. There may also be the option to implement compensating controls such as MACsec along the link. I don't think Juniper switches support, but ISE also supports DTLS and IPsec for encryption between NAD and PSN. IPsec may be sufficient for this connection, but client to NAD is still in clear.
On a related note, I did find this useful post: cisco - Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? - Information Security Stack Exchange
In short, I think it is best to confirm with your security team/auditor as to best approach where endpoints do not support more secure auth protocols. There is obviously a difference between "will it work" versus "does it sufficiently protect" versus "compliance checkbox".
Craig
