Cisco Catalyst 2960 Software Configuration Manual page 238

Controlling Switch Access with RADIUS
To initiate session authentication, the AAA server sends a standard CoA-Request message which
contains a Cisco vendor-specific attribute (VSA) in this form:
Cisco:Avpair="subscriber:command=reauthenticate" and one or more session identification attributes.
The current session state determines the switch response to the message. If the session is currently
authenticated by IEEE 802.1x, the switch responds by sending an Extensible Authentication Protocol
over LAN (EAPoL) RequestId message to the server.
If the session is currently authenticated by MAC authentication bypass (MAB), the switch sends an
access-request to the server, passing the same identity attributes used for the initial successful
authentication.
If session authentication is in progress when the switch receives the command, the switch terminates the
process, and restarts the authentication sequence, starting with the method configured to be attempted
first.
If the session is not yet authorized, or is authorized via guest VLAN, or critical VLAN, or similar
policies, the reauthentication message restarts the access control methods, beginning with the method
configured to be attempted first. The current authorization of the session is maintained until the
reauthentication leads to a different authorization result.
Session Reauthentication in a Switch Stack
When a switch stack receives a session reauthentication message:
•
•
•
•
•
Session Termination
There are three types of CoA requests that can trigger session termination. A CoA Disconnect-Request
terminates the session, without disabling the host port. This command causes re-initialization of the
authenticator state machine for the specified host, but does not restrict that host's access to the network.
To restrict a host's access to the network, use a CoA Request with the
Cisco:Avpair="subscriber:command=disable-host-port" VSA. This command is useful when a host is
known to be causing problems on the network, and you need to immediately block network access for
the host. When you want to restore network access on the port, re-enable it using a non-RADIUS
mechanism.
When a device with no supplicant, such as a printer, needs to acquire a new IP address (for example,
after a VLAN change), terminate the session on the host port with port-bounce (temporarily disable and
then re-enable the port).
CoA Disconnect-Request
This command is a standard Disconnect-Request. Because this command is session-oriented, it must be
accompanied by one or more of the session identification attributes described in the
Identification" section on page
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
9-24
It checkpoints the need for a re-authentication before returning an acknowledgement (ACK).
It initiates reauthentication for the appropriate session.
If authentication completes with either success or failure, the signal that triggered the
reauthentication is removed from the stack member.
If the stack master fails before authentication completes, reauthentication is initiated after stack
master switch-over based on the original command (which is subsequently removed).
If the stack master fails before sending an ACK, the new stack master treats the re-transmitted
command as a new command.
9-22. If the session cannot be located, the switch returns a
Chapter 9 Configuring Switch-Based Authentication
"Session
OL-26520-01