At a university engineering lab, ISE profiles wired endpoints behind Cisco switches. A conference IP phone has been recategorized and needs a new dACL on its existing session, an access point must switch from MAB to 802.1X, and a laptop tied to an incident must have its live session ended immediately. Which CoA action fits each of the three cases?
Select an answer to reveal the explanation.
Short Explanation
Refresh the policy, restart the handshake, or end the session — each CoA message does one job only. The phone needs its new dACL on a session that stays up, you bounce the access point so it starts 802.1X from scratch, and the flagged laptop needs its session gone right now. It's the same toolbox, just three different keys.
Full Explanation
CoA reauthentication is the right tool when the authorization result changes: ISE sends a reauth request carrying the session identifier, the network device re-runs the authorization decision and applies the new dACL. A port bounce restarts the session itself, so the endpoint has to start over; it is the appropriate action to move a device from MAB to 802.1X, since reauthentication would repeat MAC authentication rather than start EAP. A disconnect terminates the RADIUS session at the network device, ending its live access rather than re-granting it. Bouncing the port for a routine policy update works technically but forces a full re-handshake, the wrong trade-off when the session must stay up. Bouncing the port to clear the flagged laptop fails to ensure access remains removed because the endpoint can re-establish a session and be authorized again. Reauthenticating to change the authentication method fails because the network device repeats the same method rather than starting EAP. Exam caveat: CoA only works when the network device has the correct ISE shared secret and CoA enabled, and a cleared session cannot be reauthenticated. Practical check: watch the ISE RADIUS live logs for the CoA-ACK, then confirm the new dACL on the switch session.