300-715 · Question #241
An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command…
The correct answer is A. aaa server radius dynamic-author. To allow network devices to accept Change of Authorization (CoA) packets from Cisco ISE, the aaa server radius dynamic-author command must be configured. This command enables the device to act as a CoA client and respond to authorization changes initiated by the RADIUS server.
Question
An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command must be configured on the devices to accomplish this goal?
Options
- Aaaa server radius dynamic-author
- Bauthentication command bounce-port
- Cauthentication command disable-port
- Daaa nas port extended
How the community answered
(20 responses)- A85% (17)
- C10% (2)
- D5% (1)
Why each option
To allow network devices to accept Change of Authorization (CoA) packets from Cisco ISE, the `aaa server radius dynamic-author` command must be configured. This command enables the device to act as a CoA client and respond to authorization changes initiated by the RADIUS server.
`aaa server radius dynamic-author` is the specific Cisco IOS command that enables a network access device (NAD) to receive and process CoA or Disconnect messages from a RADIUS server like Cisco ISE. This configuration is essential for dynamic authorization changes, such as re-authenticating a session or applying a new policy without user re-authentication.
`authentication command bounce-port` is not a standard IOS command for enabling CoA reception; it relates to port actions after authentication failures.
`authentication command disable-port` is not a standard IOS command for enabling CoA reception; it relates to port actions after authentication failures.
`aaa nas port extended` is related to reporting detailed NAS port information in RADIUS attributes, not to enabling CoA reception.
Concept tested: Configuring NAD for RADIUS Change of Authorization (CoA)
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_rad/configuration/xe-3s/sec-usr-rad-xe-3s-book/sec-rad-config.html#GUID-ED9A93F6-13AB-4252-8228-569D0F32E50D
Topics
Community Discussion
No community discussion yet for this question.