topic expected Radius Attributes for CoA Reauth (Cisco ISE and X440-G2) in ExtremeSwitching (EXOS/Switch Engine)

expected Radius Attributes for CoA Reauth (Cisco ISE and X440-G2)

StefanS — Sun, 05 Jun 2022 12:11:00 GMT

Hi Communtiy,
since 22.1 the CoA feature are supported in the Summit software.
At the moment we are facing the challenge of bringing several X440-G2 switches into the ISE NAC environment.
The network device profile for Extreme works so far but CoA shows a very unreliable behavior as only a CoA disconnect according to RFC5176 works.
Does the Summit series in version 31.5 also support Reauth?
Radius attributes for Disconnect and Reauth can be configured in the Network Device Profile of the ISE.
Since disconnect works I assume that the radius configuration on the switch is basically correct.
Unfortunately I can't find any documentation for Exos which attributes are expected from the switch? Does the CoA Reauth Request need to include other AVPs besides Calling-Station-ID, NAS-IP-Address and Timestamp?
Thanks a lot for your help,
Stefan

RE: expected Radius Attributes for CoA Reauth (Cisco ISE and X440-G2)

StefanS — Mon, 06 Jun 2022 13:17:00 GMT

Hi Community,
supplementary to my question the info that the timestamp was already added as AVP and the time is also identical on ISE and Switch.
The switch sends back a CoA-NaK with the note missing-attributes.
Stefan

RE: expected Radius Attributes for CoA Reauth (Cisco ISE and X440-G2)

Miguel-Angel_RO — Tue, 07 Jun 2022 08:00:00 GMT

Here what XMC is sending:
Mig