Hi,
I did eventually find a "sorta" fix. I had jumbo frames enabled, disabling them fixed the problem temporarily. the problem has returned in a different form now. the radius server doesn't even see the auth requests now, and the client just won't even try to authenticate. I think this qualifies as a different issue, that I need to pursue separately. should I follow up here, or is it an issue I should contact my switch manufacturer about, or is it a windows problem?
if the server doesnt even see the auth attempts when the client is physically connected to the switch then take a good long look at the switch. use all the commands etc that you can on that switch - the show commands, the debug commands etc to find out what its doing or failing to do. we've had quite a few issues over the years with manufacturers and how they read the specs - life wouldnt be the same without a few interesting firmware upgrades (and cryptic changelogs that come with them). we had a recent one where cisco voip firmware blocked EAP-TLS through the softswitch - kinda annoying. alan