force clients to use new ISE DACL

[tachyon05]

After changing ISE DACL in the ISE GUI, end user devices don't seem to get the updated DACL until I initiate a port bounce.  That requires either a COA in ISE or SHUT/NO SHUT the port on an access switch, but this works for one end user device at a time.  

Is there a way to force a COA on all ports with an active session that is subject to this DACL, both on demand and on a schedule?

[ahollifield · Accepted solution]

Maybe through the API?  Otherwise yes pushing a new dACL requires a new authentication request.  You can trigger that by manually sending a CoA re-auth to the NAD or by manually bouncing the port.

[tachyon05]

Thanks.  Would you please share how to "sending a CoA re-auth to the NAD?

Is there way to force CoA for only devices in 1 MAB group and not any other MAB or any 802.1x clients?

[ahollifield · Accepted solution]

This is a manual process from Context Visibility.