topic Issue with Posture with Cisco ISE and Aruba CX switch. in Network Access Control

Issue with Posture with Cisco ISE and Aruba CX switch.

Sergey Polski — Thu, 11 Jan 2024 14:43:53 GMT

Hello everyone.

I have the following setup. 1 ISE 3.2 (patch 4) server (running in my Lab for PoC) and 1 Aruba 6000 switch with latest 10.13.0005 firmware.

I have defined NAD profile for Aruba by copying pre-defined profile for Aruba Wireless and added custom VSA for port bounce.

Port bounce work correctly while re-authentication does not. I've tried to use radius atributes from the following post, but this haven't worked for me. I'm getting 407, Invalid Attribute Value from the switch.

https://community.cisco.com/t5/network-access-control/802-1x-coa-reauthenticate-aruba-switch/m-p/4822423#M581394

If I'm trying to do posture without re-authentication, ISE send CoA request to the switch, switch bounces the port and posture module on Cisco Secure Client run again, send result to ISE and ISE bounces the port. And it hapens over and over.

Have anyone implemented posture with Aruba CX switches?

Thank you

Re: Issue with Posture with Cisco ISE and Aruba CX switch.

hslai — Sat, 13 Jan 2024 04:09:13 GMT

@Sergey Polski If ISE is sending AVP as configured in the NAD profile, then please seek support from the NAD product support team as to why it is giving you invalid attribute value.

Note that, for NAD profiles, only fixed values are supported for the attributes to be sent as part of CoA requests from ISE. This is a known issue -- CSCwe52049.

Re: Issue with Posture with Cisco ISE and Aruba CX switch.

bdartar01 — Wed, 15 Oct 2025 07:31:09 GMT

Hello,

We are performing Cisco ISE posture POC with Aruba AOS-CX switches. We made a few changes to the Aruba dictionary and we added aruba cx switch to the ISE after duplicated and configured the aruba wireless profile. But I don't find a useful document about configuration required for posture on Cisco ISE when using an Aruba cx switch and also configuration required for posture on Aruba cx switch when using Cisco ISE. Friends who have tried this before, can you share your configuration example (your steps) and experiences?

Regards,