I'm currently doing a penetration test for a client, who are using Trustwave NAC to prevent unauthorized physical access to their network.

I would like to know if there are any possible ways to bypass this. Client is putting a lot of faith in their implementation (with good cause so far), but I would like to be able to bypass it if possible to demonstrate, if nothing else that reliance on a single security technology is not a good solution.

Short of trying to DOS the device (I have permission to try this), I'm not sure what could be attempted.

This device does is not simple port security. It uses ARP poisoning to hide the actual gateway, and puts all devices in a quarantine LAN until they are authenticated against an Active Directory server. Spoofing a MAC of someone else in the quarantine LAN will not help, unless I can also trick the NAC device into think I was a device that had previously authenticated against AD.

Looking for known techniques, academic papers, conference presentations etc.