topic Re: Why doesn't Cisco ISE kick out the session? in Wireless https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469174#M291982 <P>Yes, this is the AP's IP address. I have added the complete subnet range 10.100.175.0/24.</P><P>Do you think this issue occurs when I send the termination request, and it connects to a nearby AP instead of the AP the client was originally connected to?</P><P>the way i added to NAD ? Is it a correct way since there is no WLC</P><P><SPAN class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AnkitSharma1_0-1736381979716.png" style="width: 400px;"><span class="lia-inline-image-display-wrapper" image-alt="image.png"><img src="https://community.cisco.com/t5/image/serverpage/image-id/276023iE2D0594552D3D0D1/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></SPAN></P> Thu, 09 Jan 2025 00:21:05 GMT ankitohc 2025-01-09T00:21:05Z Why doesn't Cisco ISE kick out the session? https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469172#M291980 <P>Team,</P><P>We have configured Cisco ISE with MR46, but when I try to send a session reauthentication request or termination, it does not go through. What could be the reason?</P><P>Once a user is authenticated, I cannot kick them out of the network. I'm not sure why</P><P><SPAN class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AnkitSharma1_0-1736376995935.png" style="width: 438px;"><span class="lia-inline-image-display-wrapper" image-alt="image.png"><img src="https://community.cisco.com/t5/image/serverpage/image-id/276018i4C3F4E693D308F00/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></SPAN></P><P><SPAN class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AnkitSharma1_1-1736377076107.png" style="width: 400px;"><span class="lia-inline-image-display-wrapper" image-alt="image.png"><img src="https://community.cisco.com/t5/image/serverpage/image-id/276020i67B7329A717A3813/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></SPAN></P><P>COA is already checked in the access control option</P> Wed, 08 Jan 2025 23:00:21 GMT https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469172#M291980 ankitohc 2025-01-08T23:00:21Z Re: Why doesn't Cisco ISE kick out the session? https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469173#M291981 <P>Can you confirm that the wireless client is still connected to 10.100.175.175 ? Is ISE sending the request to the correct AP ?</P> Wed, 08 Jan 2025 23:30:15 GMT https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469173#M291981 Raphael_L 2025-01-08T23:30:15Z Re: Why doesn't Cisco ISE kick out the session? https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469174#M291982 <P>Yes, this is the AP's IP address. I have added the complete subnet range 10.100.175.0/24.</P><P>Do you think this issue occurs when I send the termination request, and it connects to a nearby AP instead of the AP the client was originally connected to?</P><P>the way i added to NAD ? Is it a correct way since there is no WLC</P><P><SPAN class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AnkitSharma1_0-1736381979716.png" style="width: 400px;"><span class="lia-inline-image-display-wrapper" image-alt="image.png"><img src="https://community.cisco.com/t5/image/serverpage/image-id/276023iE2D0594552D3D0D1/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></SPAN></P> Thu, 09 Jan 2025 00:21:05 GMT https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469174#M291982 ankitohc 2025-01-09T00:21:05Z Re: Why doesn't Cisco ISE kick out the session? https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469175#M291983 <P>the NAD is fine. You just have to make sure that the client was connected to 10.100.175.175 at the moment the CoA was sent.</P><P>Eg : Client was on AP1 10.100.175.175 , Roamed to AP2 10.100.175.180 , CoA sent to AP1 , but AP1 can't kick the client since the client is no longer on AP1. </P><P>You don't have 802.11r enabled right ?</P> Thu, 09 Jan 2025 00:30:59 GMT https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469175#M291983 Raphael_L 2025-01-09T00:30:59Z Re: Why doesn't Cisco ISE kick out the session? https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469176#M291984 <P><SPAN class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AnkitSharma1_0-1736383289576.png" style="width: 400px;"><span class="lia-inline-image-display-wrapper" image-alt="image.png"><img src="https://community.cisco.com/t5/image/serverpage/image-id/276025i78DF72120ACBB9DD/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></SPAN></P><P>The machine is connected at the desk and did not roam. It is connected to the same AP, but when I force a session reauthentication request or termination, it is not working correctly.</P> Thu, 09 Jan 2025 00:43:20 GMT https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469176#M291984 ankitohc 2025-01-09T00:43:20Z Re: Why doesn't Cisco ISE kick out the session? https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469177#M291985 <P>in Cisco ISE, session reauthentication means that the user will need to enter their login credentials again, right? I did that, but it connects again without asking for a username or password</P> Thu, 09 Jan 2025 00:45:21 GMT https://community.cisco.com/t5/wireless/why-doesn-t-cisco-ise-kick-out-the-session/m-p/5469177#M291985 ankitohc 2025-01-09T00:45:21Z