An engineer is writing firewall rules between a Catalyst switch and Cisco ISE and must understand CoA traffic direction. Normal RADIUS authentication flows from the switch to ISE. Which statement describes how CoA messages flow?
Select an answer to reveal the explanation.
Short Explanation
Usually the switch asks and ISE answers. CoA flips that conversation around: ISE speaks first, and the switch replies with an ACK or NAK. So you need a firewall rule that lets ISE start the conversation toward the switch, not just the other way.
Full Explanation
In standard RADIUS, the network access device is the client and initiates every exchange by sending Access-Request and Accounting-Request messages to the server. Change of Authorization reverses the initiator: ISE sends an unsolicited CoA-Request or Disconnect-Request to the switch, and the switch, acting as a dynamic authorization server, replies with an ACK or NAK. Firewall rules therefore need to permit traffic initiated from ISE toward the switch on the dynamic authorization port, in addition to the usual authentication and accounting flows initiated from the switch. The idea that the switch sends CoA to ISE when a session is idle inverts the direction; idle handling is local timer behavior on the switch, not CoA. Endpoints do not participate in RADIUS at all; the supplicant speaks EAP to the switch and has no role in CoA. ISE does not relay CoA through the endpoint; it sends the message directly to the switch's management address. Exam caveat: the CoA port differs from the authentication port and its default varies by implementation, so confirm the port configured on both sides rather than assuming it. Operational check: capture traffic from the ISE node to the switch while triggering a CoA and confirm a request and its acknowledgment.