topic Re: CoA Type in Network Access Control

CoA Type

EdouardZorrilla0939 — Fri, 23 Jul 2021 15:37:09 GMT

Greetings,

'Port Bounce' or 'Reauth' is available in Administration > System > Settings > Profiling. I have it set as 'Reauth'

How do I actually make ISE to send a 'Port Bounce' to place a device in a separate VLAN.

Please help me understand that.

Edouard.

Re: CoA Type

ahollifield — Fri, 23 Jul 2021 16:09:49 GMT

Change the global CoA type to port bounce. You can also specify a specific CoA result for a particular policy.

Re: CoA Type

EdouardZorrilla0939 — Fri, 23 Jul 2021 20:11:46 GMT

Hello Aholli, where in a policy can the CoA be specified.

Thanks,

Re: CoA Type

saxenanitesh8522 — Sat, 24 Jul 2021 17:17:39 GMT

hi,

in the authorization policy you can change the coa

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html

CoA Request Commands Supported on the Device

Command

Cisco VSA

Bounce host port

Cisco:Avpair=“subscriber:command=bounce-host-port”

Disable host port

Cisco:Avpair=“subscriber:command=disable-host-port”

Reauthenticate host

Cisco:Avpair=“subscriber:command=reauthenticate”

Terminate session

This is a standard disconnect request that does not require a VSA

Re: CoA Type

Greg Gibbs — Mon, 26 Jul 2021 00:05:34 GMT

Keep in mind that bouncing the port will likely not solve the issue of an endpoint requesting a new IP address after a dynamic VLAN assignment if that is your goal. Bouncing the port will clear the RADIUS session, so the entire process starts over. You'll likely see the exact same issue after the port bounce due to the race condition between the time the endpoint requests an IP address and the dynamic VLAN assignment happens again. More than likely, you'll just end up in a loop of port bouncing.

If your endpoint is connected behind a phone, the port bounce will also reboot the phone as the POE power also bounces.

If your goal is to mitigate DHCP issues with dynamic VLAN assignment, see the post below for suggestions.

802.1x New IP address after CoA