Cisco ISE 2.1 - Where configure CoA shared secret?

[Bernhard Roth]

Hello!

I have a test installation of Cisco ISE 2.1 (Patch 2).

I have configured a switch with aaa dynamic author, IP of ISE and a shared secret for correct CoA operation.

When doing a CoA operation, the switch does complain about a wrong secret.

I have searched a lot in docs and the web interface but maybe I'm a bit blind.

Where can I configure the shared secret for my switch on ISE web interface?

Best regards,

Bernhard

[Rahul Govindan · Accepted solution]

AFAIK, the shared secret section under Administration > Network Resources > Network Devices is used for both Radius and COA. So you only have to define it once on your ISE.

For switches, you have to define it twice, but if you are using it with ISE, you need to have it set to the same.

WLC also has one definition for shared secret if I recall correctly.

[Bernhard Roth]

Thank you very much! It works!

It was a bit strange for me to believe that the same shared secret had to be configured twice on a single switch.

Do you "have to know it" or is there somewhere a reference in the documentation?

[Rahul Govindan]

Interestingly, I have not found this documented anywhere, know it from trial and error (more of the error). It probably is hidden somewhere within the bundles of information on the Cisco documentation site :)