topic Re: How ISE Bunce or reauthenticate a port in Network Access Control

How ISE Bunce or reauthenticate a port

Hevin27 — Thu, 25 Jul 2024 08:02:20 GMT

Hi all,

Does anyone know how to set up the authorization profile to bounce ports or re-authenticate sessions? I see that ISE has this feature in Live Session, but I want to use this feature in the authorization policy.

Re: How ISE Bunce or reauthenticate a port

MHM Cisco World — Thu, 25 Jul 2024 11:28:28 GMT

the ISE send CoA to NAD and NAD re-auth or bounce port
this use only for Guest Client

MHM

Re: How ISE Bunce or reauthenticate a port

ccieexpert — Thu, 25 Jul 2024 16:57:50 GMT

it can be done, please read this and caveats:

https://community.cisco.com/t5/network-access-control/coa-type/td-p/4437873

What is your exact use case ?

** please rate as helpful if this is useful**

Re: How ISE Bunce or reauthenticate a port

Hevin27 — Fri, 26 Jul 2024 01:44:53 GMT

Hi MHM,

Yes, I would like to use this feature for the Guest client. When the guest completes self-registration, the guest's device is automatically registered to the identity group, ISE will send a CoA to the NAD to bounce the port, and ISE will assign a new VLAN on this group. I set Cisco:Avpair="subscriber:command=bounce-host-port" as per some documentation, but it doesn't work.

I also tried macros but it didn't work either.

Re: How ISE Bunce or reauthenticate a port

Hevin27 — Fri, 26 Jul 2024 01:46:37 GMT

hi expert,

Thanks for the reply, I also saw this page, unfortunately, it doesn't work.

Re: How ISE Bunce or reauthenticate a port

MHM Cisco World — Fri, 26 Jul 2024 01:51:15 GMT

NAD is SW or WLC?

MHM

Re: How ISE Bunce or reauthenticate a port

Hevin27 — Fri, 26 Jul 2024 04:11:53 GMT

hi MHM,

it is sw, catalyst 9300

Re: How ISE Bunce or reauthenticate a port

PSM — Fri, 26 Jul 2024 08:25:53 GMT

Hi @Hevin27 , Did you check Radius live logs if COA event is happening in logs ? If yes have you configured dynamic author in NAD (Switch) ? Also make sure UDP 1700 is allowed between ISE and switch.

Re: How ISE Bunce or reauthenticate a port

MHM Cisco World — Fri, 26 Jul 2024 14:20:21 GMT

https://bst.cisco.com/quickview/bug/CSCvq94660

It bug check cisco for solution.

MHM

Re: How ISE Bunce or reauthenticate a port

Hevin27 — Fri, 26 Jul 2024 15:16:49 GMT

hi @PSM, Yes, we checked all of them. in the radius live logs, we can see the Cisco:AV-Pair is successfully applied, and other attributes such as changing the VLAN or granting the DACL can be successfully executed in the same authorization profile, only this av-pair not run.

Re: How ISE Bunce or reauthenticate a port

Hevin27 — Fri, 16 Aug 2024 08:01:17 GMT

i found the root case. i need to change this.