We have the ME60 connected to S9300 switch. The user is connected directly to the S9300 Gigabit Ethernet interface. The software version of the ME60 is V100R006C05SPC600, the software version of the S9312 switch is V100R002C00SPC200. The client uses the Windows XP SP3 and use the standard Windows 802.1x authentificator. The client also uses the MD5 digest key exchange as the exchange method of passwords. The configuration of the ME60 You can see in the attachment BRAS.txt.
When the client sends the EAP start message, the BRAS doesn't see it.
To allow the switch to forward it to BRAS there is a need to configure the switch with "BPDU enable" command on the user interface. Thus, the switch will not process the EAP start message by himself but will send it to the BRAS. The configuration of the switch is in the attachment switch.txt
The root cause of the problem is that the client sends the EAP start message with destinaiton MAC address as the special multicast address (see in the attachment capture.pcap). The switch sends it to SRU for processing instead of forwarding it to the BRAS.
It's better to configure the 802.1x client on Windows using the MD5 digest (see the attachment 802.1x_picture.jpg). To enable the 802.1x authentication on the Windows XP SP2 there is a need to enable the "Wired AutoConfig" service on it.