An insurance firm runs posture on its wired ports. Endpoints authenticate with EAP-TLS and sit on a quarantine VLAN until Secure Client reports its posture result, after which the switch must update the live session immediately without anyone reconnecting. Users report they stay quarantined until someone unplugs the cable. Which control makes ISE re-evaluate the session after the posture check passes?

Enabling RADIUS Change of Authorization (CoA) lets ISE signal the access switch to re-evaluate the active session when the posture result becomes available. The switch can then obtain and apply the compliant authorization profile without requiring the user to unplug the cable or initiate a new connection. A short periodic 802.1X reauthentication interval is a legitimate way to refresh authorization, but it only takes effect at the next scheduled exchange; it does not provide the immediate update required here. A CoA Disconnect is also a standard control, but it terminates the current session and relies on a new EAP-TLS session to restore access, contrary to the requirement to update the live session without reconnection. A downloadable ACL is a common way to enforce traffic permissions, but it controls traffic under an authorization state; by itself, it does not cause ISE to re-evaluate posture or replace the quarantine authorization with the compliant profile. Exam caveat: distinguish a CoA Reauthenticate action, which triggers reauthentication for an existing session, from CoA Disconnect, which tears down the session. Practical check: verify that ISE sends the intended CoA after the posture pass and that the switch accepts it and changes the session’s authorization result.