topic Re: Locating reason why COA was issued in ISE log in Network Security

Locating reason why COA was issued in ISE log

ryan14 — Mon, 21 Dec 2020 16:39:55 GMT

My ISE server sometimes reports dynamic authorization failed for device. How do I locate what triggered this event in ISE?

Description :

Network Device has denied the Change of Authorization request issued by ISE Policy Service nodes

Re: Locating reason why COA was issued in ISE log

Rob Ingram — Mon, 21 Dec 2020 16:50:38 GMT

Hi @ryan14

There could be many reasons why a CoA was sent by the PSN, profiling, posture, ANC, CWA etc. Typically it could be a new endpoint connected to the network for the first time, profiled and a CoA is sent. You should see the Endpoint Profile changed to match a new Profile.

If you are getting a CoA failed, then check the NAD to confirm whether you have the following configuration defined.

aaa server radius dynamic-author
 client 192.168.10.10
 server-key Cisco1234

HTH

Re: Locating reason why COA was issued in ISE log

ryan14 — Mon, 21 Dec 2020 17:55:48 GMT

Thanks, is there a log file I can look at to see what generated the coa?

Re: Locating reason why COA was issued in ISE log

Rob Ingram — Mon, 21 Dec 2020 18:33:09 GMT

If you check the message in the live log, it will tell you the source component and the reason for the CoA. From the example you can see that the CoA was sent because the endpoint was profiled and change endpoint identity group.

If you wish to debug further you can enable debugging for the individual features

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html