We have seen problem with authentication order after we upgraded from 2.1 to 2.4 . We currently have 100% MAB authentication but have running config for last 6 months :
authentication order dot1x mab
authentication priority dot1x mab
But after we upgraded to 2.4 we needed to change order to mab first to get clients especially win xp clients that have dot1x active to get an IP. It looks like it never tries to go to mab authentication when we check logs in ISE. This was never a problem before upgrade, either with dot1x on clients without certificate or the order. Anyone have any ideas what could have changed between 2.1 to 2.4 around this?
I would like to keep the order with dot1x first as we now start rolling out new clients with certificate.
