Cisco ISE shows that it sent CoA requests to a Catalyst access switch, but sessions on the switch never change and ISE reports no acknowledgment. RADIUS authentication itself works normally. What is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation
Normal RADIUS works because the switch talks first; CoA flips it around and ISE talks first. If you haven't told the switch to listen for ISE as a dynamic authorization client, or your key doesn't match, it just ignores the knock. Don't blame the supplicant; CoA never reaches the endpoint at all.
Full Explanation
For CoA to work, the network access device must act as a dynamic authorization server that accepts unsolicited RADIUS messages from ISE. On Cisco IOS XE this is configured under the dynamic authorization section, listing ISE as a client with a shared server key. If that configuration is missing, or the key does not match the one configured for the device in ISE, the switch silently discards or rejects the CoA and ISE sees no acknowledgment, while ordinary authentication continues to work because it uses the separate RADIUS client path. Mismatched authentication ports would break authentication itself, which the stem says is working. A missing VLAN or dACL attribute in an authorization profile would cause an unexpected result after reauthentication, but the switch would still acknowledge the CoA and reauthenticate. The supplicant is not involved in CoA; the exchange occurs between ISE and the switch, and the switch then reauthenticates the session on the endpoint's behalf. Exam caveat: firewalls between ISE and the switch must also permit the CoA traffic, which uses a different port from authentication. Operational check: verify the dynamic authorization configuration and key on the switch, then trigger a reauthentication CoA from ISE live sessions and confirm an ACK is logged.