Cisco Catalyst 2960 Software Configuration Manual page 237

Chapter 9 Configuring Switch-Based Authentication
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
+-+-+-+-+-+-+-+-+-+-+-+-+-
The attributes field is used to carry Cisco VSAs.
CoA ACK Response Code
If the authorization state is changed successfully, a positive acknowledgement (ACK) is sent. The
attributes returned within CoA ACK will vary based on the CoA Request and are discussed in individual
CoA Commands.
CoA NAK Response Code
A negative acknowledgement (NAK) indicates a failure to change the authorization state and can include
attributes that indicate the reason for the failure. Use show commands to verify a successful CoA.
CoA Request Commands
This section includes:
•
•
•
•
•
•
Beginning with Cisco IOS Release 12.2(52)SE, the switch supports the commands shown in
Table 9-4
Command
Reauthenticate host
Terminate session
Bounce host port
Disable host port
1. All CoA commands must include the session identifier between the switch and the CoA client.
Session Reauthentication
The AAA server typically generates a session reauthentication request when a host with an unknown
identity or posture joins the network and is associated with a restricted access authorization profile (such
as a guest VLAN). A reauthentication request allows the host to be placed in the appropriate
authorization group when its credentials are known.
OL-26520-01
Code | Identifier
Attributes ...
Session Reauthentication
Session Reauthentication in a Switch Stack
Session Termination
CoA Disconnect-Request
CoA Request: Disable Host Port
CoA Request: Bounce-Port
CoA Commands Supported on the Switch
1
Cisco VSA
Cisco:Avpair="subscriber:command=reauthenticate"
This is a standard disconnect request that does not require a VSA.
Cisco:Avpair="subscriber:command=bounce-host-port"
Cisco:Avpair="subscriber:command=disable-host-port"
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
| Length
Authenticator
Controlling Switch Access with RADIUS
|
|
|
|
|
Table 9-4.
9-23