A network engineer has set up a FlexVPN server to terminate multiple FlexVPN clients. The VPN tunnels are established without issue. However, when a Change of Authorization is issued by the RADIUS ser

CoA requests are addressed to the network access server (the FlexVPN server), not to VPN clients; configuring dynamic authorization on the clients has no effect on whether the server processes CoA messages.

A RADIUS shared-key mismatch between the RADIUS server and the FlexVPN server would cause all RADIUS authentication to fail; because the question states that VPN tunnels establish successfully, the shared key is not the issue.

The `aaa server radius dynamic-author` command enables the RADIUS Dynamic Authorization (RFC 3576/5176) listener on the FlexVPN server, allowing it to receive and act on CoA requests sent by the RADIUS server. Without this command the server silently ignores all incoming CoA packets, so session authorizations are never updated even though the tunnels themselves remain established. Enabling this command causes the server to re-apply authorization policy to active sessions when a CoA is received.

FlexVPN clients authenticate against the FlexVPN server, not directly against the RADIUS server, so a key mismatch between RADIUS and clients is irrelevant to CoA processing on the FlexVPN server.