A hospital admits infusion pumps with MAB and laptops with 802.1X. After a profiler update reclassifies an admitted pump, the new authorization must apply immediately, but a reauthentication request leaves its session unchanged, the pump sits idle for minutes, and it must return to service without any manual clearing. Which CoA type should ISE send for that pump?

A port bounce is the best fit because it cycles the switch interface, forcing the pump’s existing access session to end and a new MAB admission to occur. That new admission lets ISE evaluate the updated profiling classification and apply the resulting authorization without waiting for the idle pump to generate traffic or requiring an administrator to clear the session manually. A Disconnect CoA is a valid way to terminate a session, but by itself it does not make an idle endpoint initiate MAB again; the pump could remain out of service until it sends traffic, contrary to the immediate-return requirement. A policy-update CoA can update a downloadable ACL while retaining the session, but that only addresses the ACL; the scenario requires the new authorization, which may include other session attributes, to take effect. A reauthentication CoA is commonly used to trigger policy reevaluation, but the question explicitly says that a reauthentication request leaves this pump’s session unchanged, so repeating that mechanism does not solve the observed behavior. Exam caveat: CoA behavior depends on the NAD, session type, and configured authorization changes; a port bounce is disruptive and should not be treated as universally preferable. In practice, verify that the switch supports interface-bounce CoA for the pump’s session, that ISE has the updated profile and policy, and that the resulting admission receives the intended authorization.