A warehouse label printer authenticates through MAB and is being moved into a quarantine policy that places it in a different VLAN with its own subnet. The printer keeps the address it already has unless the interface link drops, so the new policy alone would leave it addressing the old subnet. Which CoA action should ISE send so the printer re-learns its address in quarantine?
Select an answer to reveal the explanation.
Short Explanation
A port bounce briefly drops and restores the link, prompting your printer to request a fresh DHCP address and start a new session in quarantine. Reauthentication or a disconnect leaves the link up, so it keeps its old-subnet address—like changing the route on a map without restarting the trip.
Full Explanation
A port-bounce CoA deliberately drops and restores the switch-port link. That link transition gives this printer the event it needs to start DHCP again, now in the quarantine VLAN, so it can obtain an address from that subnet. Reauthentication can cause ISE to evaluate policy and apply the quarantine authorization, but DHCPFORCERENEW does not meet the stated device behavior: the printer retains its current address unless the interface link drops. A Disconnect CoA clears the authentication session and allows a new MAB session, but a fresh authentication is not the same as a physical link-down event; with the link still up, the printer may continue using its old address. Changing the switch-port VLAN and clearing the server-side lease can prepare the new network and scope, but clearing a server lease does not remove the lease held by the client, and this approach also does not provide the requested CoA action. Exam caveat: CoA support and the exact effects of reauthentication, disconnect, and port-bounce actions vary by NAD and configuration, so confirm the device’s behavior rather than assuming every CoA resets DHCP. As a practical check, verify the port-down/up event and confirm that a new DHCP Discover/Offer exchange uses the quarantine scope.