Locating reason why COA was issued in ISE log

[ryan14]

My ISE server sometimes reports dynamic authorization failed for device. How do I locate what triggered this event in ISE?

Description :

Network Device has denied the Change of Authorization request issued by ISE Policy Service nodes

[Rob Ingram]

Hi @ryan14 

There could be many reasons why a CoA was sent by the PSN, profiling, posture, ANC, CWA etc. Typically it could be a new endpoint connected to the network for the first time, profiled and a CoA is sent. You should see the Endpoint Profile changed to match a new Profile.

If you are getting a CoA failed, then check the NAD to confirm whether you have the following configuration defined.

aaa server radius dynamic-author
 client 192.168.10.10
 server-key Cisco1234

 HTH

[ryan14]

Thanks, is there a log file I can look at to see what generated the coa?

[Rob Ingram · Accepted solution]

If you check the message in the live log, it will tell you the source component and the reason for the CoA. From the example you can see that the CoA was sent because the endpoint was profiled and change endpoint identity group.

If you wish to debug further you can enable debugging for the individual features

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html