How ISE Bunce or reauthenticate a port

[Hevin27]

Hi all,

Does anyone know how to set up the authorization profile to bounce ports or re-authenticate sessions? I see that ISE has this feature in Live Session, but I want to use this feature in the authorization policy.

[MHM Cisco World]

the ISE send CoA to NAD and NAD re-auth or bounce port 
this use only for Guest Client 

MHM

[Hevin27]

Hi MHM,

Yes, I would like to use this feature for the Guest client. When the guest completes self-registration, the guest's device is automatically registered to the identity group, ISE will send a CoA to the NAD to bounce the port, and ISE will assign a new VLAN on this group. I set Cisco:Avpair="subscriber:command=bounce-host-port" as per some documentation, but it doesn't work.

I also tried macros but it didn't work either.

[MHM Cisco World]

NAD is SW or WLC?

MHM

[Hevin27]

hi MHM,

it is sw, catalyst 9300

[MHM Cisco World]

https://bst.cisco.com/quickview/bug/CSCvq94660

It bug check cisco for solution.

MHM

[ccieexpert]

it can be done, please read this and caveats:

https://community.cisco.com/t5/network-access-control/coa-type/td-p/4437873

What is your exact use case ?

** please rate as helpful if this is useful**

[Hevin27]

hi expert,

Thanks for the reply, I also saw this page, unfortunately, it doesn't work.

[PradeepSingh]

Hi @Hevin27 , Did you check Radius live logs if COA event is happening in logs ? If yes have you configured dynamic author in NAD (Switch) ? Also make sure UDP 1700 is allowed between ISE and switch. 

[Hevin27]

hi @PradeepSingh, Yes, we checked all of them. in the radius live logs, we can see the Cisco:AV-Pair is successfully applied,  and other attributes such as changing the VLAN or granting the DACL can be successfully executed in the same authorization profile, only this av-pair not run.

[Hevin27 · Accepted solution]

i found the root case. i need to change this.