M4350 switch doesn't fallback to guest network

Hi,

I trying to setup 802.1x (EAP-TLS) with a fallback guest VLAN.

802.1x works correctly for devices that have the certificate, but devices that don't send EAP packages don't get put in the guest VLAN (666).

They just get stuck in with an 169.254.X.X address.

Below is the relevant config:

vlan database
vlan 101-102,666
vlan name 101 "Office"
vlan name 102 "Voice"
vlan name 666 "Guest"
set igmp-plus 101
set igmp-plus 102
set igmp-plus 666
set mld-plus 101
set mld-plus 102
set mld-plus 666
vlan routing 1 1
exit

ip http port 49151
configure
stack
member 1 9
member 2 7
exit
switch 1 priority 14
switch 2 priority 15
username "admin" password xxx encryption-type sha512 level 15 encrypted
authentication enable
dot1x software version 1
aaa authentication dot1x default radius
authorization network radius
radius accounting mode

radius server host auth "192.168.1.252" name "nas001"
radius server key auth "192.168.1.252" encrypted xxxx
radius server primary "192.168.1.252"
radius server host acct "192.168.1.252" name "nas001"
radius server key acct "192.168.1.252" encrypted xxxx
line console
serial timeout 60
exit

interface 1/0/1
authentication periodic
authentication timer reauthenticate 60
authentication event fail action authorize vlan 666
authentication event no-response action authorize vlan 666
dot1x timeout quiet-period 3
dot1x timeout tx-period 5
spanning-tree edgeport
switchport mode access
switchport access vlan 666
exit

Any idea's what I'm doing wrong?

Thanks in advance!