Some Apple BYOD having problems connecting to 802.1x EAP WPA2 AES

[garrett_collier]

We have a ZD3000 w/ R600s and R700 APs. Lately, with all the issues presented from Win 10, we've been struggling to keep a handle on our BYOD. One thing I changed that helped a lot with the Win 10 devices was setting our NPS to identify with its machine Cert over our corporate wildcard cert. I'm finding, now, that some of the Apple devices (iPhone 6, 7 MacBook Pro) do not like this at all and fail to receive an address from DHCP. -Others do not. I can't seem to find a rhyme or reason as to inconsistency of this problem. I'm considering purchasing a stand alone certificate for the radius/nps box, but thought I would seek some advice before trying that. Any suggestions would be greatly appreciated.

[francis_aromin]

Thanks for the tip!  Apple has always been notorious for breaking compatibility with their updates.  It's just strange that we can't pinpoint an iOS version that's causing it this time.  
We managed to upgrade to the latest 9.12 build.  We still have about 40 ZF7363s on our network, but hopefully we can replace those soon so we can upgrade to 9.13 or even 10.

[francis_aromin]

FYI, we were able to resolve our 802.1x / iOS issues by trimming down our SSIDs, removing extra services (e.g. client fingerprinting, application visibility, etc), then rebooting everything (ZD, all APs, even Radius).  

My guess is that our older 7363s and 7372s couldn't take the extra overhead.