802.1X authentification with dynamic VLANs breaks Windows 7 DHCP

[HEKnet]

Hello everybody,

we use the 5400 series and have 802.1X authentification enabled. We use FreeRADIUS 2.10 with PEAP and MsCHAPv2.  The VLAN is dynamically assigned by the RADIUS Access-Accept reply depending on the given user.

Most of the time this works fine, but sometimes Windows 7 clients complain about "limited connectivity". The reason is that Windows 7 does not correctly obtain an IP through DHCP, but chooses an APIPA adress.

A wireshark trace reveals that Windows 7 sends the DHCP discover before the authentication completes. Most of the time the authentication process is successful and VLAN assignment is done before the third DHCP discover times out. But in rare occasions, Windows 7 sends all three DHCP discover messages / request messages, before the VLAN assignment is established and then tries an APIPA address.

Of course, this is mainly a Windows 7 bug, because Windows 7 should first authenticate and then try to obtain an IP address, not the other way around. But I did not find anything in the web on that topic, but a sole CISCO help board entry, that essentially states "yes, we know this issue".