We've got a largely working 802.1x infrastructure. The Windows clients are using certificates issued by our Enterprise PKI, and we've got both computer and user certificates.
The intention is that if the computer or the user is valid, then NPS tells the switch which VLAN to put the user into, otherwise the switch puts them into the "guest" VLAN.
The problem we are seeing - and this mostly seems to happen when the computers are initially starting up/user is logging on - is that valid computers & users seem to be initially going into the guest VLAN (because the computer gets a DHCP-assigned IP address from that pool) and then authentication completes, the switch puts the computer into the correct VLAN but the computer isn't realising this and therefore doesn't request a new IP address from DHCP.
What I'm struggling to resolve is why the switch is ever putting the computer/user into the guest VLAN in the first place. This is proving to be difficult to troubleshoot because anything I need to do at the client end is really hard to do because the computer is starting up and I don't have access.
What can I do from the switch end? What logs can I look at or what additional diagnostics can I enable that might help me figure out what is going on here?
Any other suggestions as to what I can try or look at?
Thanks.
Philip
