topic Re: Help needed : Change of vlan using CoA in Network Access Control

Help needed : Change of vlan using CoA

s_muthukannan — Wed, 08 May 2019 12:50:03 GMT

Hi All,

Planning to change the vlan of the user through CoA.Not able to find option to push the vlan via CoA can you please help

lab-setup ( this is used for demo to customer not the production deployment)

ciscoISE-----ISAM-7360------ONT----STC
Cisco ISE version: 2.3.0.298
ISAM-7360 : Nokia OLT ( Optical Line Terminal, formerly Alcatel-lucent OLT)
ONT : optical network termination
STC (Spirent test centre for simulating 802.1x supplicant or enddevice)

user/endpoint is authenticated and allocated dynamic vlan. I proceed to Radius live session and trying to perform CoA action.
I could see only session termination but not change of vlan option. Using the VSA attribute A-ESAM-PoL-Fwd-ID to change the vlan.

Attached screen shot
1) CoA action only listing termination action for the live session
2) network device profile configured to push the CoA. (806 is the vlan to be pushed )

Note with the freeradius server able to do change of vlan (radius code 43)

Thanks,
S.Muthukannan.

Re: Help needed : Change of vlan using CoA

howon — Wed, 08 May 2019 14:56:22 GMT

ISE CoA actions in general are not something that can be manipulated to contain authorization attributes such as VLAN ID. What you are describing is CoA push and is mainly supported for VPN access. In general ISE sends CoA disconnect (In case of 3rd party devices) and separate authorization policy rule will have to provide different VLAN ID when network device sends new ACCESS request.

Reach out to me directly howon@cisco.com and I can try to help you with the policy if you have a setup that we can test with.

Re: Help needed : Change of vlan using CoA

s_muthukannan — Wed, 08 May 2019 15:17:25 GMT

Thanks for the reply. I have mailed you separately on this.

regards,

S.Muthukannan