ISE 2.4 Wired 4500 switch COA not working after compliant status.

[joeharb]

We are testing Posturing wired workstations, but the COA is not working...

I see the switch receive the COA:

Nov 9 17:21:16.119: RADIUS: Received from id 1646/42 10.4.37.151:1813, Accounting-response, len 20
Nov 9 17:21:36.436: RADIUS: COA received from id 15 10.4.37.151:50666, CoA Request, len 180
Nov 9 17:21:36.436: RADIUS: Unable to find client with addr 10.4.37.151, tableid 2
Nov 9 17:21:41.439: RADIUS: COA received from id 15 10.4.37.151:50666, CoA Request, len 180
Nov 9 17:21:41.439: RADIUS: Unable to find client with addr 10.4.37.151, tableid 2

Not sure why the client's addr is seen as 10.4.37.151, that is the ISE server.

Any Suggestions?

Joe

[gbekmezi-DD]

Do you have that RADIUS server configured in the 4500?

aaa server radius dynamic-author

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-3s/sec-usr-aaa-xe-3s-book/sec-rad-coa.html#GUID-46B9CBDC-1F98-4606-B742-F33323268EDChttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-3s/sec-u...

[joeharb]

Yes...

aaa server radius dynamic-author
client 10.4.37.151 server-key 7 XXXXXXXXX

I also see this when debugging aaa coa

: COA: 10.4.37.151 client not configured. Dropping COA packet

[Surendra · Accepted solution]

Do you have vrf configured for RADIUS requests by any chance? A running configuration for at least the radius servers configuration would help. I would also suggest to remove and add the dynamic-author config again and see if it helps.

[joeharb]

That was it...

I have removed it before and added it...but this time I did a question mark and able to specify the VRF.

Thanks so much...

Joe

[joeharb]

Everything is working as expected...I have added to more Posture Policy Requirements to the existing policy, but the client is not updating it's checks, it still only see's the original 2 required.  Is there a mechanism to force the client to update the posture policy?

Thanks,

Joe

[gbekmezi-DD · Accepted solution]

Hey Joe, good question. I suggests marking this one as solved and opening a new thread to help future searches.