After a profiling update, an office laptop and a lobby camera both need new authorization right away. The laptop's 802.1X supplicant supports reauthentication and its live session must stay up. The camera is a MAB endpoint whose firmware never re-registers unless its port link drops. Which CoA action should ISE apply to each session?
Select an answer to reveal the explanation.
Short Explanation
You can reauthenticate the laptop so it gets the new authorization while keeping its live session up. For the camera, use a port bounce—like briefly unplugging and reconnecting it—so it re-registers and gets the new authorization.
Full Explanation
The laptop supports 802.1X reauthentication, so ISE can trigger a new authorization on its existing session without interrupting the live connection. The camera uses MAB, and its firmware will not initiate registration again while the port remains up; bouncing the camera’s port drops the link and prompts the endpoint to register and receive its updated authorization. Reauthenticating both sessions is insufficient because an in-place reauthentication request does not make this camera re-register. Bouncing both ports can refresh both authorizations, but it interrupts the laptop session, contrary to the requirement that it stay up. Sending a CoA disconnect to the camera terminates its session, but it does not drop the physical port link; this firmware therefore will not re-register, leaving the camera without the new authorization. Exam caveat: the behavior of CoA reauthentication, disconnect, and port-bounce actions depends on the switch platform and its ISE integration, so do not assume they have equivalent effects. In practice, verify the endpoint’s session type and the switch’s supported CoA behavior, then confirm the laptop session remains established and the camera receives a fresh MAB authorization after the port bounce.