A laptop connects with 802.1X, Cisco ISE assigns a posture-pending profile, and the posture agent then reports the laptop compliant. The user must receive full access without unplugging or rebooting. What makes the new policy take effect?
Select an answer to reveal the explanation.
Short Explanation
RADIUS normally only speaks when the switch asks, so you need a way for ISE to tap the switch on the shoulder. That's CoA: ISE says "reauthenticate that session" and the new compliant policy lands right away. Waiting for a timer works eventually, but the user's stuck until then.
Full Explanation
Standard RADIUS is request-response, so an authorization decision normally changes only when the network access device sends a new request. Change of Authorization, defined in RFC 5176, lets the RADIUS server send an unsolicited message to the NAD to change an active session. When the posture agent reports compliance, ISE updates the posture status and sends a reauthentication CoA. The switch reauthenticates the session, the authorization policy now matches the compliant rule, and the full-access profile is applied, all without disconnecting the user. Waiting for the periodic reauthentication timer would eventually apply the policy, but the delay could be long and is not the designed mechanism. The posture agent communicates with ISE, not with the switch's RADIUS client, and endpoints never send RADIUS requests themselves; the NAD does. Asking the user to unplug and reconnect would trigger a new authentication, but it violates the requirement and is the manual workaround that CoA exists to eliminate. Exam caveat: CoA requires dynamic authorization to be configured on the NAD with ISE as an allowed client. Operational check: in ISE live sessions, confirm a CoA event follows the posture report and that the session's authorization profile changes to full access.