Change of Authorization

What it is

Change of Authorization, or CoA, lets ISE change the access of a session that is already running.

Normally the network device asks and ISE answers. CoA turns this round, so ISE sends a message to the device and the device acts on one session.

It is defined in RFC 5176 as an extension to RADIUS.

How it works

The PSN sends a CoA message to the device, which then reauthenticates the session or ends it.

Why CoA is needed

Without CoA, the result from the first authentication stays until the session ends. That is a problem in several flows:

• Profiling: An endpoint starts as unknown, and ISE learns what it is later.
• Guest: The user signs in on a portal after the first authorization.
• Posture: A client passes its compliance check after the first result.
• Block action: An administrator marks an endpoint as blocked.

In each case the first result is out of date, and ISE needs the device to ask again.

CoA types

ISE can send several kinds of CoA. The choice affects how disruptive it is.

Reauthenticate is the gentle one, and it is the usual choice. The port bounce is used when the endpoint has to renew its address, for example after a VLAN change, because a bounce makes the endpoint see a link down and up.

Do not bounce a port that has an IP phone with a PC behind it unless you have to, because both devices lose link.

In the message, the action travels as a Cisco vendor specific attribute. A reauthentication carries a command to reauthenticate, and a port bounce carries a command to bounce the port.

Where the CoA type is set

There are two levels. A global setting under the profiling settings says which CoA type ISE uses when an endpoint changes profile. An individual profiling policy can choose its own, or use the global one.

The authorization flows for guest and posture send a reauthentication by themselves. The type is part of the flow.

Configure the device

The device must allow ISE to send CoA, so the PSN is listed as a client. On IOS XE this uses the dynamic author block.

Switch(config)# aaa server radius dynamic-author
Switch(config-locsvr)# client 10.1.1.11 server-key SECRET

Add an entry for every PSN that may send CoA. If you have several PSNs, a session can be handled by any of them. The device then rejects CoA from a PSN that is not on the list.

On ISE, the network device entry holds the shared secret and, in the RADIUS settings, the CoA port. The CoA port on Cisco devices is UDP 1700 by default, although RFC 5176 names 3799. The key must be the same on both sides.

On a wireless controller the policy profile needs NAC turned on, so that it accepts CoA for the session.

The effect of CoA on a session

During a reauthentication the device sends a new request, and ISE applies the policy again with the new data. The result may differ from the first. For example, the endpoint gets a new VLAN or ACL.

Be aware of how the VLAN change reaches the endpoint. A VLAN change by reauthentication does not by itself make the endpoint request a new IP address. Many designs avoid VLAN changes after authentication for this reason, and use ACLs instead.

Troubleshooting

Switch# show authentication sessions interface GigabitEthernet1/0/5 details
Switch# debug radius

First check on ISE. The live logs show a CoA event with a status of success or failure, and a failure usually carries a reason.

If ISE shows no CoA sent, look at the policy that should send it. If it shows failure, look at the device.

The common causes of failure are a missing client in the dynamic author block, a wrong shared secret, and a firewall that blocks UDP 1700 between the PSN and the device.