All -
Our organization runs 2960x access switches. ISE 2.2. Integration with AD. All windows 10 devices. We have been doing wired dot1x for many months now. Computers are set to Computer & User authentication. Our ruleset look something like this -
1. If Domain Machine result = onboard vlan
2. If Domain Machine & id in group A = vlan A
3. If Domain Machine & id in group B = vlan B
Everything was working fine. Once a particular cumulative update came down, KB4535996 things started breaking. A machine will onboard just fine. ISE indicates the onboard rule hit, switch indicates onboard vlan. PC gets an onboard IP and is reachable on the network.
Once a group A / B id logs in, the network side of things seem ok. ISE indicates the A / B ID hit, switch applies appropriate vlan. Logs on windows machine indicate a successful dot1x user change. There is very little delay - maybe 1-2-3 seconds after typing your domain pw and hitting enter the port switches vlans. Problem is the device never does DHCP a second time. It retains the onboard ip it had previously. After maybe 30 seconds the globe in the system tray pops up instead of the normal pc/monitor icon and connectivity is lost. I've waited for an hour or more but still no dhcp request - I've spanned the client switchport - a dhcp request is never generated or leaves the client.
You can force a dhcp renew via ipconfig /release and /renew and it works fine - the moment you hit enter on /renew the request leaves, the normal dhcp steps take place, and everything is happy again.
You can uninstall the update KB4535996 and the problem goes away - onboard > student/staff switch happens seamlessly as it has been before. You can reinstall the same update on the machine and it breaks again. It is very repeatable and consistent across many machines - various dell and MS models, various nics (even usb > ethernet dongles) etc. It seems this update has changed default behavior (perhaps not on purpose) to re-do dhcp on a dot1x user change.
Hoping someone's run into this. Any thoughts or ideas? Easy solution is to add a script on startup that runs a release and renew. That actually works, tested it. But just seems like it's band-aiding a bigger issue.
