A warehouse runs ISE with profiling enabled. A Cisco VoIP handset with an active call is re-profiled into a new authorization profile, and the switch can reauthenticate it. A label printer found on the wrong VLAN ignores reauthentication but re-enters authentication after a port bounce. A quarantined scanner must have its live session ended at the switch instead of being re-admitted under another profile. Which CoA action applies to each endpoint?
Select an answer to reveal the explanation.
Short Explanation
You can treat CoA like three different reset buttons: reauthenticate the handset, bounce the printer’s port, and disconnect the scanner’s session. That way, each device gets the action it can handle—or the session-ending action it needs.
Full Explanation
ISE selects a CoA action based on the required outcome and what the network access device can do; the device must act on the CoA request. A reauthentication CoA tells the switch to reauthenticate the existing session, which fits the handset and avoids bouncing its port, which would disrupt the active call. A port bounce is appropriate for endpoints such as printers that do not respond to reauthentication, because shutting and reopening the port forces new authentication. A disconnect, or DM, removes the session outright, as required for the quarantined scanner; bouncing its port could instead allow it to authenticate again. The switch must be defined in ISE and reachable on its configured CoA port. Check the change in the RADIUS live logs for the CoA result and the newly applied authorization profile.