topic Re: COA destination IP in Wireless

COA destination IP

Alexs20 — Wed, 23 Aug 2023 21:48:22 GMT

Hi,

Assuming that I have one AP connected to Meraki cloud, with "MAC-based access control (no encryption)" security mode enabled.

I also have "RADIUS CoA support" option enabled.

What is the destination IP for CoA messages? Is it the same as Meraki console FQDN?

Thanks

Re: COA destination IP

Philip D'Ath — Wed, 23 Aug 2023 22:15:45 GMT

I don't know the answer - but surely it would be it would be the source of the original RADIUS request - the AP itself.

Re: COA destination IP

Alexs20 — Wed, 23 Aug 2023 22:21:42 GMT

That means that I cannot use external RADIUS server (means hosted in internet) as AP sits behind the firewall.

Hmmm, ok, thanks.

Re: COA destination IP

Brash — Wed, 23 Aug 2023 23:20:56 GMT

Similar to @Philip D'Ath, I also don't know the answer but I think you're right.
CoA would require the RADIUS server sending a request to the AP which isn't really possible without an inbound NAT or proxy.

I initially thought you could look at using the Meraki RADIUS proxy but it doesn't support CoA.

Re: COA destination IP

Alexs20 — Thu, 24 Aug 2023 17:06:21 GMT

Looks like I need a little more help.

So, I am trying to talk to AP using radclient utility

my command is

echo '
Calling-Station-Id = "<MAC redacted>"
NAS-IP-Address = 192.168.2.224
Filter-Id = "PASS"
Event-Timestamp = "1692895863"
cisco-avpair="subscriber:command=reauthenticate"
cisco-avpair="subscriber:reauthenticate-type=rerun"
' | radclient -x 192.168.2.224:3799 coa <secret redacted>

But there is nothing coming back.

192.168.2.224 - is IP of my AP and this is what i see in Access-Request message when connecting to SSID

Any ideas?

Thanks

Re: COA destination IP

Alexs20 — Thu, 24 Aug 2023 18:42:42 GMT

oh, NM, I found the problem. I had to add my PC IP into the list of radius servers