Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1381 / 2086

49-101
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Controlling Switch Access with RADIUS
If the session is not yet authorized, or is authorized by using guest VLAN, or critical VLAN, or similar policies, the
reauthentication message restarts the access control methods, beginning with the method configured to be attempted first. The
current authorization of the session is maintained until the reauthentication leads to a different authorization result.
Session Termination
Three types of CoA requests can trigger session termination. A CoA Disconnect-Request terminates the session, without
disabling the host port. This command causes re-initialization of the authenticator state machine for the specified host, but does
not restrict that hosts’ access to the network.
To restrict a hosts’ access to the network, use a CoA Request with the Cisco:Avpair="subscriber:command=disable-host-port"
VSA. This command is useful when a host is known to be causing problems on the network, and you need to immediately block
network access for the host. When you want to restore network access on the port, reenable it using a non-RADIUS mechanism.
When a device with no supplicant, such as a printer, needs to acquire a new IP address (for example, after a VLAN change),
terminate the session on the host port with port-bounce (temporarily disable and then re-enable the port).
CoA Disconnect-Request
This command is a standard Disconnect-Request. Because this command is session-oriented, it must be accompanied by one
or more of the session identification attributes described in the
“Session Identification” section on page 49-99 . If the session
cannot be located, the switch returns a Disconnect-NAK message with the “Session Context Not Found” error-code attribute.
If the session
is located, the switch terminates the session. After the session has been completely removed, the switch returns
a Disconnect-ACK.
If the switch fails-over to a standby switch before returning a Disconnect-ACK to the client, the process is repeated on the new
active switch when the request is re-sent from the client. If the session is not found following re-sending, a Disconnect-ACK
is sent with the “Session Context Not Found” error-code attribute.
CoA Request: Disable Host Port
This command is carried in a standard CoA-Request message that has this new VSA:
Cisco:Avpair="subscriber:command=disable-host-port"
Because this command is session-oriented, it must be accompanied by one or more of the session identification attributes
described in the
“Session Identification” section on page 49-99 . If the session cannot be located, the switch returns a CoA-NAK
message with the “Session Context Not Found” error-code attribute. If the session is located, the switch disables the hosting
port and returns a CoA-ACK message.
If the switch fails before returning a CoA-ACK to the client, the process is repeated on the new active switch when the request
is re-sent from the client. If the switch fails after returning a CoA-ACK message to the client but before the operation has
completed, the operation is restarted on the new active switch.
Note
A Disconnect-Request failure following command re-sending could be the result of either a successful
session termination before change-over (if the Disconnect-ACK was not sent) or a session termination
by other means (for example, a link failure) that occurred after the original command was issued and
before the standby switch became active.
CoA Request: Bounce-Port
This command is carried in a standard CoA-Request message that contains the following new VSA:
Cisco:Avpair="subscriber:command=bounce-host-port"