I am using ISE2.0 with HP Procurve switch 2920 which supports CoA.

[anil-sudharsanan.valanparambil]

I want know how to configure CoA attributes under network device profile .

Procurve does support port-bounce and Disconnect.

I want to know how can a CoA message can be send to NAD which puts the client into a quarantine vlan by this.

Is it possible to use CoA push, if so how can I send this manually.

[Jeffrey Jones · Accepted solution]

You have to create a new HP Device Profile, and also create all the HP attributes in the dictionary, the HP Port Bounce one is missing from the default profile because HP has not update the RFC since 2006.

[anil-sudharsanan.valanparambil]

Thank you Jeffery for the quick reply to my post

I have already created a NAD profile for HP switch and added HP port bounce in dictionary file.

Port-bounce is working for me when i send from endpoint profiling.

I have configured IETF attributes Tunnel-pvt-ID,tunnel-type and tunnel-medium-type under CoA Push option.

Now I want to manually send this to my NAD so that it will change the vlan dynamically to a quarantine vlan for the current

authenticated client.

This is for quarantining the client so that access to any resources will be denied.

If I use port-bounce client is getting authenticated after the bounce time period.

Another option is to use port-shutdown option but HP NAD doesnt support it.

[Jeffrey Jones]

yes, was very surprised HP does not support something as simple a port-shutdown command like the rest of the switches in the world do.

[davidgranathkarlsson]

Hi

You may use snmp-CoA as a workaround.

For re-auth (which, as far as I'm concerned isn't supported on procurve devices) OID 1.3.6.1.4.1.11.2.14.11.5.1.25.1.2.2.1.4 (object hpicfDot1xSMAuthReauthenticate) is working perfectly fine. Or 1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.4 (hpicfUsrAuthPortReauthenticate) for MAB implementations.

Port-bouce using snmp, technically, isn't an issue, however when providing your ISE-nad-profile with the OIDs for port disable and then port enable, ISE will send both snmp set commands at the same time and the switch ends up doing nothing. I've tried running those snmp set commands manually with a 1 second delay for the port enable command and those tests were successful.

Obviously CoA port-shutdown using snmp isn't a problem since it's just one snmp set command and not two

[Jeffrey Jones]

the SNMP does not work as well as you would like it too, customer ended up replacing all HP switches with Cisco due too so many issues.