A clinic laptop passes 802.1X and then fails posture. ISE is supposed to move that session onto a remediation VLAN without a new association. What must ISE send?
Select an answer to reveal the explanation.
Short Explanation
Posture failed after the laptop was already in. You do not need a new association to move it. ISE sends a Change of Authorization that moves the session onto the remediation VLAN, and a channel change will not.
Full Explanation
Change of Authorization lets the RADIUS server change an active session. After a failed posture result, ISE sends CoA to the wireless controller, and the controller reauthorizes the laptop onto the remediation VLAN without waiting for the laptop to forget the WLAN and associate again. That is the message the clinic design is missing if the laptop stays on the production VLAN. A DHCP lease gives an address on whatever VLAN the session is already using. The access point does not complete posture by handing out a lease, and posture is not a DHCP function. An 802.11k neighbor report is a list of nearby access points for scanning. It does not quarantine a client or change its VLAN. RRM channel changes move a radio to a different channel. They do not select a remediation VLAN, and the laptop's authorization is independent of the channel number. Exam caveat: the controller has to accept CoA from that ISE node, and the remediation VLAN has to exist. A CoA that names a missing VLAN fails even though the posture result was right. Operational check: fail posture on a test laptop and confirm the controller log shows a CoA and the session VLAN changes to remediation without a disconnect.