topic Re: CoA Port Bounce with Cisco ISE and Aruba 2530 in Network Access Control

CoA Port Bounce with Cisco ISE and Aruba 2530

joerg — Wed, 04 Nov 2020 11:12:07 GMT

Hi,

I am actually trying to implemement profiling with the Cisco ISE (2.7 patch2) and Aruba 2530 (SW 16.10.011).
After profiling the devices, the ISE sends a CoA POrt Bounce to the switch.
But I am still getting a "Missing attribute" back from the switch.

On the switch, I have configured the following for CoA:
radius-server host <IP-address> key <Some Pass>
radius-server host <IP-address> dyn-authorization
radius-server host <IP-address> time-window 0

The CoA-NAKs increase with every attempt.

On the ISE, I have configured the following for the device profile:

from a packet dump, I can see that only a few attributes are sent to the switch via CoA:

Any idea what´s missing here?

Regards
Joerg

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

Mohammed al Baqari — Wed, 04 Nov 2020 11:56:13 GMT

Seems there is a glitch cuz CoA should include NAS-Port-ID for the port to
be bounced. I don't see it in the snapshot. I know this the case for Cisco
switches. We might be having interop issue here. Look for initial radius
access request and see if it includes port id.

***** please remember to rate useful posts

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

joerg — Wed, 04 Nov 2020 13:05:09 GMT

Hi Mohammed,

I will try and let you know about the results.

Thanks

Regards

Joerg

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

Damien Miller — Thu, 05 Nov 2020 06:58:10 GMT

Here's what I recently used for Aruba CoA, it tested out fine. We changed to UDP 1700 on the Aruba config to match the Cisco equipment in the environment and existing load balancer config. To be fair, this is being used on wireless/wired with 303 model RAPs. I don't have a proper hp/aruba switch.

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

joerg — Mon, 09 Nov 2020 14:13:25 GMT

Hi Mohammed,

I have added the NAS-Port-ID, but still the same.

The NAS-Port-ID is included in the initial Radius access request, but missing in the CoA of the ISE.

Regards

Joerg

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

Mohammed al Baqari — Mon, 09 Nov 2020 16:13:21 GMT

Hi,

Did you follow the configs suggested by @Damien Miller.? Try it as it could
work. If NAS-Port-ID is not sent, the switch won't know which port to
bounce, unless the session ID is included in CoA.

In anyway, you need to tweak it to overcome this interop issue. I am sorry
but no experience with Aruba integration.

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

joerg — Tue, 10 Nov 2020 07:04:35 GMT

Hi Damien,

unfortunately, this did not work for me with the HPE switches.

I will do some further investigations.

Thanks.

Regards

Joerg

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

joerg — Mon, 16 Nov 2020 13:28:55 GMT

Hi everybody,

finally I got the following configuration from TAC, which worked for my case.

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

SudarshanCherukupally13196 — Wed, 05 Oct 2022 15:33:49 GMT

Hi @Damien Miller ,

I am in similar situation. Where my Aruba controllers in DMZ space and with Wired Guest Traffic. It has 3799 port for CoA. I want to do CoA Port bounce. I have also made the "CoA Termination" in the Guest HotSpot Portal.

Will your network device profile setting still work in my case ?

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

ahollifield — Wed, 05 Oct 2022 16:58:01 GMT

I would use the Network Device Profile linked in this article here: How To: Cisco ISE Captive Portals with Aruba Wireless - Cisco Community

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

SudarshanCherukupally13196 — Wed, 05 Oct 2022 22:13:53 GMT

HI @ahollifield , the article is wonderful made and brilliant. we are suing the similar way with Aruba-captive-portal-url vsa. All working good with the Aruba Wireless Controllers. Problem we have with Aruba Wired Controllers. So we are looking to do CoA PortBounce in the new custom device profile. Since Cisco didnt have provided the Aruba Wired Controller network device profile. It has for HP an Alcatel Wired.

Regards,
Sudarshan

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

ahollifield — Thu, 06 Oct 2022 11:26:30 GMT

Ahh got it. Wired controller like you are doing UBT to a mobility controller? Is there a wired switch involved here?

Re: CoA Port Bounce with Cisco ISE and Aruba 2530

Shorty — Mon, 16 Sep 2024 20:56:39 GMT

This worked for Dell S3148P's but I just needed the following:

Radius-NAS-Port = 0

Dell-Force10:Force10-av-pair = cmd=bounce-host-port