After a device is reprofiled, Cisco ISE must move it from VLAN 50 to VLAN 60. The device does not renew its DHCP lease on a reauthentication, so it keeps an address from the wrong subnet. Which CoA type should be used?
Select an answer to reveal the explanation.
Short Explanation
A reauth can change the VLAN on the switch, but the device has no clue anything happened, so it keeps its old IP. You need the link to flicker so it thinks "new network, better ask DHCP again." That's exactly what the port bounce does.
Full Explanation
Cisco ISE supports several CoA types. A reauthenticate CoA asks the switch to reauthenticate the session while the link stays up; it works well when the new authorization changes a dACL or SGT, because the endpoint's IP address remains valid. When a VLAN changes, however, many endpoints, especially headless devices, do not detect the change and keep an IP address from the old subnet. A port bounce CoA shuts down the switch port briefly and brings it back up; the endpoint sees link loss, re-initiates DHCP, and obtains an address in the new VLAN while the new authorization takes effect. A plain reauthentication is exactly what the stem says fails, because the device does not renew DHCP. Session termination without a port change ends the session and may lead to reauthentication, but the link stays up, so the device still does not see a reason to renew its lease. Periodic reauthentication at a short interval adds load and still does not cycle the link, so it does not fix the addressing problem. Exam caveat: port bounce affects every device on the port, so on a multi-device port a reauth may be preferred, which is why ISE avoids port bounce for multiple sessions on a port. Operational check: after the CoA, confirm the device holds an address in the new subnet.