CoA Request: Disable Host Port The RADIUS server CoA disable port command administratively shuts down the authentication port that is hosting a session, resulting in session termination. This command is useful when a host is known to cause problems on the network and network access needs to be immediately blocked for the host. To restore network access on the port, reenable it using a non-RADIUS mechanism. This command is carried in a standard CoA-Request message that has this new vendor-specific attribute (VSA):
Cisco:Avpair="subscriber:command=disable-host-port" Because this command is session-oriented, it must be accompanied by one or more of the session identification attributes described in the “Session Identification” section. If the session cannot be located, the device returns a CoA-NAK message with the “Session Context Not Found” error-code attribute. If the session is located, the device disables the hosting port and returns a CoA-ACK message. If the device fails before returning a CoA-ACK to the client, the process is repeated on the new active device when the request is re-sent from the client.
If the device fails after returning a CoA-ACK message to the client but before the operation has completed, the operation is restarted on the new active device. Note A Disconnect-Request failure following command re-sending could be the result of either a successful session termination before change-over (if the Disconnect-ACK was not sent) or a session termination by other means (for example, a link failure) that occurred after the original command was issued and before the standby device became active. CoA Request:
Bounce-Port A RADIUS server CoA bounce port sent from a RADIUS server can cause a link flap on an authentication port, which triggers DHCP renegotiation from one or more hosts connected to this port. This incident can occur when there is a VLAN change and the endpoint is a device (such as a printer) that does not have a mechanism to detect a change on this authentication port. The CoA bounce port is carried in a standard CoA-Request message that contains the following VSA: Cisco:Avpair="subscriber:command=bounce-host-port" Because this command is session-oriented, it must be accompanied by one or more of the session identification attributes.
If the session cannot be located, the device returns a CoA-NAK message with the “Session Context Not Found” error-code attribute. If the session is located, the device disables the hosting port for a period of 10 seconds, re-enables it (port-bounce), and returns a CoA-ACK. If the device fails before returning a CoA-ACK to the client, the process is repeated on the new active device when the request is re-sent from the client. If the device fails after returning a CoA-ACK message to the client but before the operation has completed, the operation is re-started on the new active device.
Stacking Guidelines for Session Termination No special handling is required for CoA Disconnect-Request messages in a switch stack. Stacking Guidelines for CoA-Request Bounce-Port Because the bounce-port command is targeted at a session, not a port, if the session is not found, the command cannot be executed. When the Auth Manager command handler on the active switch receives a valid bounce-port command, it checkpoints the following information before returning a CoA-ACK message: Configuring RADIUS CoA Request: Disable Host Port Configuring RADIUS 10