> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # ISE CoA in Practice: Reauth, Port Bounce and a VLAN Change Pushed from ISE - URL: https://www.pinglabz.com/ise-coa-reauth-port-bounce-live-sessions/ - Published: 2026-10-31T14:56:00.000Z - Updated: 2026-10-31T15:52:37.000Z - Description: I pushed Change of Authorization from ISE 3.5 to an access switch three ways: a reauth that moved a logged-in user from the staff VLAN to quarantine without dropping the link, a port bounce, and a broken CoA key that produced 5417 Dynamic Authorization failed. Real output for each. - Author: Jaime - Tags: Network Security, Troubleshooting, Labs, 802.1X 802.1X decides what a user gets when they log in. Change of Authorization (CoA, RFC 5176) is how ISE changes that answer *after* login. Move someone into a quarantine group, and the switch won't notice until the next reauthentication timer. That can be hours away. Unless ISE tells the switch to act now. This post sends CoA from ISE to an access switch three ways and shows what each one looks like on the switch and in ISE Live Logs: 1. **Reauth**: the user moves from the staff VLAN to quarantine on the same session, with no link flap. 2. **Port bounce**: ISE shuts the port and brings it back up, so the endpoint starts over. 3. **Fault**: the CoA key on the switch doesn't match ISE, and Live Logs shows **5417 Dynamic Authorization failed**. I built this in my home lab with **Cisco ISE 3.5.0.527**, a **Cisco IOSv-L2 15.2** access switch and a Linux host running **wpa\_supplicant 2.11** for PEAP-MSCHAPv2\. All output is real. Addresses are documentation values, and secrets and passwords are placeholders. If you want the theory and the IOS XE command reference first, read [802.1X CoA Configuration on Cisco IOS XE with ISE](https://www.pinglabz.com/802-1x-coa-configuration-cisco-ios-xe-ise/). This post is the hands-on version, with real Live Logs. ## The lab | Device | Role | Addressing | | ------- | -------------------------------------------------------------------------- | --------------------------------- | | ise35 | Cisco ISE 3.5, RADIUS server and CoA sender | 192.0.2.10 | | acc-sw6 | IOSv-L2 15.2 access switch, 802.1X authenticator, CoA listener on UDP 1700 | Gi0/0 10.86.250.10/24 in VRF MGMT | | ws-61 | Linux host, wpa\_supplicant 2.11, PEAP-MSCHAPv2 as user emp-61 | MAC 00:00:5E:00:53:61 on Gi0/1 | [![Fault diagram: ws-61 authenticates by EAPOL on acc-sw6, which sends RADIUS to ise35; ise35 sends CoA (UDP 1700) back to reauthenticate or bounce the port. A dynamic-author server-key mismatch fails CoA with 5417 (11103). Reauth keeps the session ID; port bounce makes a new one with link down/up.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/ise-coa-topology.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/ise-coa-topology.png?ref=pinglabz.com) Lab topology: ise35 sends CoA to acc-sw6 to reauthenticate or bounce ws-61's port | ISE object | Value | | ---------------------- | --------------------------------------------------------------------------------------------------- | | Identity groups | CoA-Staff, CoA-Quarantine | | Authorization profiles | AP-VLAN610-Staff (VLAN 610), AP-VLAN699-Quarantine (VLAN 699) | | Policy set | Wired-CoA-Lab, condition Radius:NAS-IP-Address equals 10.86.250.10 | | Authorization rules | Quarantine-VLAN699 (group CoA-Quarantine), then Staff-VLAN610 (group CoA-Staff), default DenyAccess | The base 802.1X setup is the same as [Configuring Cisco ISE as a RADIUS Server for 802.1X](https://www.pinglabz.com/configuring-cisco-ise-radius-server-802-1x/), and the VLAN profiles follow [Dynamic VLAN Assignment with 802.1X and Cisco ISE](https://www.pinglabz.com/dynamic-vlan-assignment-802-1x-cisco-ise/). Here I'll focus on the CoA parts. ## Step 1: Add the switch in ISE with CoA port 1700 In **Administration > Network Resources > Network Devices**, add `acc-sw6` with IP `10.86.250.10`, tick **RADIUS Authentication Settings** and set the shared secret. Under the advanced settings, leave **CoA Port** at **1700**. That's the Cisco default, and it's where ISE sends CoA requests. The RADIUS shared secret is also the CoA secret, so the switch must use the same key in both places. ## Step 2: Configure the switch to accept CoA The normal 802.1X config is only half of it. The `aaa server radius dynamic-author` block is what turns the switch into a CoA listener: ```cisco vlan 610 name STAFF vlan 699 name QUARANTINE ! radius server ISE-1 address ipv4 192.0.2.10 auth-port 1812 acct-port 1813 key aaa group server radius ISE server name ISE-1 ip vrf forwarding MGMT ip radius source-interface GigabitEthernet0/0 aaa authentication dot1x default group ISE aaa authorization network default group ISE aaa accounting dot1x default start-stop group ISE ! aaa server radius dynamic-author client 192.0.2.10 vrf MGMT server-key auth-type any ! radius-server vsa send accounting radius-server vsa send authentication dot1x system-auth-control ! interface GigabitEthernet0/1 description ws-61 802.1X switchport mode access switchport access vlan 610 authentication port-control auto dot1x pae authenticator spanning-tree portfast edge ``` Three details matter: - **`client ... vrf MGMT`**. My RADIUS traffic leaves through a management VRF, so the CoA client has to be in the same VRF. Without it, the switch drops CoA packets that arrive on the VRF interface. - **`server-key`** has to match the shared secret on the ISE network device. Step 6 breaks this on purpose. - **Accounting** (`aaa accounting dot1x ... start-stop`) tells ISE which sessions are active. Without accounting, ISE has no session to send CoA against. ## Step 3: Baseline, user in the staff group With `emp-61` in **CoA-Staff**, the host logs in and gets VLAN 610: ```text acc-sw6#show authentication sessions interface GigabitEthernet0/1 details Interface: GigabitEthernet0/1 MAC Address: 0000.5e00.5361 User-Name: emp-61 Status: Authorized Common Session ID: 0A56FA0A0000000E0007A8E3 Vlan Group: Vlan: 610 Method status list: Method State dot1x Authc Success ``` ## Step 4: CoA reauth moves the user to quarantine Now pretend `emp-61`'s laptop was flagged. I moved the user into **CoA-Quarantine** in ISE. Nothing happened on the switch, which is expected. The session was authorized under the old answer, and ISE doesn't re-evaluate it on its own. To push the change, open **Operations > RADIUS > Live Sessions**, find the session, and pick **CoA Action > Session reauthentication**. You can do the same thing through the MnT API: ```text GET https://192.0.2.10/admin/API/mnt/CoA/Reauth/ise35/00:00:5E:00:53:61/0 true ``` The switch reauthenticated the existing session. The supplicant ran EAP again, ISE matched the **Quarantine-VLAN699** rule, and the port moved VLANs: ```text acc-sw6#show authentication sessions interface GigabitEthernet0/1 details User-Name: emp-61 Status: Authorized Session Uptime: 17s Common Session ID: 0A56FA0A0000000E0007A8E3 Vlan Group: Vlan: 699 ``` Note that the **Common Session ID didn't change**. It's the same session with a new authorization. There was no link down/up in the switch log either. A reauth CoA is the gentle option. In Live Logs, the CoA shows up as its own row with an empty Identity column, right before the new authentication: [![ISE Live Logs showing CoA rows without an identity between emp-61 authentications, including one failed CoA](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/01-livelogs-coa-rows.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/01-livelogs-coa-rows.png?ref=pinglabz.com) ISE Live Logs showing CoA rows without an identity between emp-61 authentications, including one failed CoA Open the CoA row's details to confirm what ISE actually sent. The event is **5205 Dynamic Authorization succeeded** and the Cisco AV pair is `subscriber:command=reauthenticate`: [![ISE CoA detail: 5205 Dynamic Authorization succeeded, subscriber:command=reauthenticate sent to port 1700](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/02-coa-reauth-detail.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/02-coa-reauth-detail.png?ref=pinglabz.com) ISE CoA detail: 5205 Dynamic Authorization succeeded, subscriber:command=reauthenticate sent to port 1700 ## Step 5: CoA port bounce A reauth only works if the endpoint can handle a new VLAN on the same link. A printer or camera with a static or DHCP-leased address in the old subnet will keep that address. For those, ISE can **bounce the port**: shut it, then bring it back up, so the device sees a link drop and requests a new address. I moved `emp-61` back to **CoA-Staff** and sent the port bounce (Live Sessions **CoA Action > Port bounce**, or the MnT Disconnect API with type 1): ```text GET https://192.0.2.10/admin/API/mnt/CoA/Disconnect/ise35/00:00:5E:00:53:61/1/10.86.250.10/0.0.0.0 true ``` The switch log shows the port going down and up again about 10 seconds later: ```text *Oct 31 14:41:43: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively down *Oct 31 14:41:53: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up ``` ISE logged it as another 5205, this time with `subscriber:command=bounce-host-port`, followed by an accounting stop for the old session: [![ISE CoA detail: 5205 Dynamic Authorization succeeded with subscriber:command=bounce-host-port](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/03-coa-bounce-detail.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/03-coa-bounce-detail.png?ref=pinglabz.com) ISE CoA detail: 5205 Dynamic Authorization succeeded with subscriber:command=bounce-host-port There was one honest gotcha. After the bounce, the switch had **no session** on Gi0/1, and the port sat in its default VLAN without authorizing anything. My Linux host never saw the carrier drop, so wpa\_supplicant still thought it was authorized and didn't send a new EAPOL-Start. A physical NIC normally sees the link go down and restarts 802.1X on its own. In my lab, the host needed a nudge (`wpa_cli reauthenticate`). After that a **new** session came up in VLAN 610: ```text User-Name: emp-61 Status: Authorized Session Uptime: 17s Common Session ID: 0A56FA0A0000000F000AF3E9 Vlan Group: Vlan: 610 ``` Compare that with Step 4: a bounce gives you a **new Common Session ID**, while a reauth keeps the old one. If you bounce a port and the endpoint never comes back, check whether the client restarted 802.1X before you blame ISE. ## Step 6: Fault, CoA key mismatch gives 5417 Now let's break it. I changed only the CoA key on the switch and left the RADIUS key alone: ```cisco aaa server radius dynamic-author client 192.0.2.10 vrf MGMT server-key ``` Authentication still worked, which is what makes this fault sneaky. I moved `emp-61` to **CoA-Quarantine** again and sent the reauth. This time the API returned false: ```text false ``` The switch didn't move the user. It was still on the old session in **VLAN 610**, even though ISE policy now says quarantine. In Live Logs, the CoA row has a red status. The details show **5417 Dynamic Authorization failed** with failure reason **11103 RADIUS-Client encountered error during processing flow**, and the steps stop at 11100 "about to send request" with no 11101 "received response": [![ISE CoA detail: 5417 Dynamic Authorization failed, 11103 RADIUS-Client encountered error, resolution says verify shared secret](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/04-coa-fault-detail.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/04-coa-fault-detail.png?ref=pinglabz.com) ISE CoA detail: 5417 Dynamic Authorization failed, 11103 RADIUS-Client encountered error, resolution says verify shared secret The switch silently drops a CoA request whose authenticator doesn't validate, so ISE sees no ACK or NAK. The resolution text points at the right place: **verify the shared secret**. The fix is to put the correct key back under `dynamic-author` and send the CoA again: ```text true Vlan Group: Vlan: 699 ``` The second 5205 row in Live Logs (07:44:41) is that retry, followed by the quarantine authentication. ## Which CoA should you send? | CoA type | What the switch does | Session ID | Use it when | | ------------------------------ | ---------------------------------------------- | ---------- | ------------------------------------------------------------------------------- | | Reauth (reauthenticate) | Re-runs authentication on the existing session | Same | The endpoint can take a new VLAN or dACL on the same link (most 802.1X clients) | | Port bounce (bounce-host-port) | Shuts and re-enables the port | New | The endpoint has to renew DHCP, such as printers, cameras and IoT on MAB | | Disconnect / port shutdown | Ends the session or shuts the port | Ended | You want the device off the network until someone looks at it | ## Troubleshooting | Symptom | What to check | | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | Live Logs shows **5417 Dynamic Authorization failed** with 11103, and the steps stop after 11100 | The server-key under aaa server radius dynamic-author doesn't match the ISE network device secret, or UDP 1700 is blocked | | No CoA row at all in Live Logs | ISE doesn't consider the session active. Check aaa accounting dot1x and that accounting start reached ISE | | CoA fails only when RADIUS uses a VRF | Add vrf to the client line under dynamic-author | | CoA succeeds but the VLAN doesn't change | The user's group or the policy wasn't changed before the CoA, or a higher rule still matches. Check the authorization rule in the new authentication row | | After a port bounce the port has no session | The endpoint didn't restart 802.1X. Check the supplicant, or use reauth for that endpoint type | | Network device shows CoA port other than 1700 | Third-party switches often use 3799\. Match the ISE network device profile to the switch | ## Takeaways - A policy change in ISE doesn't touch existing sessions until the next reauth. **CoA is what makes the change take effect now.** - **Reauth** keeps the Common Session ID and doesn't flap the link. **Port bounce** gives you a new session and forces DHCP. - The switch needs `aaa server radius dynamic-author` with the **same key** as the ISE network device, and the **VRF** if RADIUS uses one. - A wrong CoA key doesn't break logins. It only shows up when you send a CoA, as **5417 / 11103** with no response from the device. - CoA rows in Live Logs have no identity. Open the details and read the **CiscoAVPair** to see which command ISE sent. Related posts: [ISE Live Logs Casebook: Five 802.1X Failures, Reproduced](https://www.pinglabz.com/ise-live-logs-802-1x-failure-codes/) and [TACACS+ for Cisco IOS XE with ISE 3.5](https://www.pinglabz.com/ise-tacacs-ios-device-admin-command-sets/).