topic Re: what does coa-push=true mean in Network Access Control

what does coa-push=true mean

jinyuanbao — Fri, 05 Aug 2022 08:10:31 GMT

Hi guys,

I'm getting the CiscoAVPair like this, and i wonder what does CiscoAVPair coa-push=true mean, it's already a coa message, what will it make switch do, i haven't find this attribute in other documents.

Many thanks.

CiscoAVPair

subscriber:command=reauthenticate, audit-session-id=37498512hkpLG_lr1lRVyNJ0VE_9z5wWyzxidA6M4NK1jLQD5Do, coa-push=true

Re: what does coa-push=true mean

Mark Elsen — Fri, 05 Aug 2022 08:25:46 GMT

- FYI : https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html#GUID-7A14410E-4CA1-4E0B-AC60-CDB1FCEDFF66

Re: what does coa-push=true mean

Marcelo Morais — Sun, 07 Aug 2022 16:44:44 GMT

Hi @jinyuanbao ,

a pulled model is used in a Standard RADIUS (RFC 2865) :😞 " ... The RADIUS Protocol, defined in [RFC2865], does not support unsolicited messages sent from the RADIUS Server to the Network Access Server (NAS) ... "

A pushed model is used in Dynamic Authorization Extensions to RADIUS - RFC 5176: " ... To overcome these limitations, several vendors have implemented additional RADIUS commands in order to enable unsolicited messages to be sent to the NAS. These extended commands provide support for Disconnect and Change-of-Authorization (CoA) packets. ... "

Since ISE 2.4, Network Admin can push CoA (also known as Dynamic Authorization Extensions to RADIUS) changes from PSN.

An example of push CoA: " ... there are many instances in which it is desirable for changes to be made to Session characteristics, without requiring the NAS to initiate the exchange. For example, it may be desirable for administrators to be able to terminate user session(s) in progress. ... "

Hope this helps !!!