I'm probably overlooking something simple. Previously, any employee could use our guest network to access Exchange via Outlook's "Outlook Anywhere" feature by entering their user name and password, or from their iPhone which has an Exchange mail account. However, now iPhones can't send or receive emails from the Exchange account, of if it manages to get the email, you can't open it. Using Outlook Anywhere will prompt for the user name and password, but will take forever to launch Outlook and then say "trying to connect" in the bottom bar. (iPhones and Outlook Anywhere works fine from outside the building.)
Because the guest network requires no password and offers only internet access, most employees use this for their iPhones and laptops (when not docked) because it's easier than putting in a password. Laziness wins! The guest network works for any other internet related tasks, including using VPN to connect back to the domain. Yes... employees sit in the conference room, use the guest network, and then VPN in to get their email and files because it's "easier" than connecting to the domain!
It doesn't matter if the access is via wi-fi or wired. Obviously, I can't plug an iPhone into a wired switch, but I get the same Outlook problems with a laptop on either the wi-fi or wired networks. The network is set up as such:
Comcast cable modem supplies DHCP to guest network only. One port from modem goes to guest network switch where all wired connections are made. Another port from the modem goes to the domain network. The main domain switch has a VLAN set up with two ports - one to the guest switch, and one to the wireless AP. The wireless AP provides access to both networks via VLAN.
I don't know exactly when the problem began. The only thing I can think of having changed was Comcast replaced the modem. They took out a 4-port business modem which I think was made by Cisco and replaced it with a 4-port Netgear business modem. I wonder if some configuration settings were never transferred.