We have a Cisco ISE cluster with 4 nodes and using CoA for Wireless. Thats working fine.
The goal is to use CoA for switchports too and configured both ISE and the switch for CoA (default port). After initiating a CoA from ISE to a specific client (switchport) we found that the CoA is never recieved by the switch.
After creating and anlysing a TCP dump on the (right) PSN we found that ISE is never sending the CoA.
Below a screendump from the TCP dump with a full authentication.
Direct after this authentication the CoA is send but its not found in the trace.
Solved! Go to Solution.
Problem has been solved!
In the TCP dump of the PAN we found intercluster CoA traffic (from PAN to PSN) on UDP 3799. This traffic was not arrived at the PSN because all intercluster traffic is firewalled. After opening UDP 3799 between all cluster nodes the PSN is sending CoA to the switch on UDP 1700.
As far as I can found in the documentation intercluster CoA traffice should be send at UDP 1700
So intercluster traffic on UDP 3799 is not as designed!
Thank you all for helping