Change-Of-Authorization Requests - Cisco Catalyst 2960-X Security Configuration Manual
Cisco ios release 15.0(2)ex
Hide thumbs
Also See for Catalyst 2960-X:
- Command reference manual (135 pages) ,
- Hardware installation manual (34 pages) ,
- Getting started manual (25 pages)
Table of Contents
Advertisement
RADIUS Change of Authorization
The request is initiated from a CoA client (typically a AAA or policy server) and directed to the device that
acts as a listener.
The table below shows the RADIUS CoA commands and vendor-specific attributes (VSAs) supported by
Identity-Based Networking Services. All CoA commands must include the session identifier between the
device and the CoA client.
Table 7: RADIUS CoA Commands Supported by Identity-Based Networking Services
CoA Command
Activate service
Deactivate service
Bounce host port
Disable host port
Session query
Session reauthenticate
Session terminate
Interface template
Change-of-Authorization Requests
Change of Authorization (CoA) requests, as described in RFC 5176, are used in a push model to allow for
session identification, host reauthentication, and session termination. The model is comprised of one request
(CoA-Request) and two possible response codes:
• CoA acknowledgment (ACK) [CoA-ACK]
• CoA non-acknowledgment (NAK) [CoA-NAK]
The request is initiated from a CoA client (typically a RADIUS or policy server) and directed to the switch
that acts as a listener.
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
62
Cisco VSA
Cisco:Avpair="subscriber:command=activate-service"
Cisco:Avpair="subscriber:service-name=<service-name>"
Cisco:Avpair="subscriber:precedence=<precedence-number>"
Cisco:Avpair="subscriber:activation-mode=replace-all"
Cisco:Avpair="subscriber:command=deactivate-service"
Cisco:Avpair="subscriber:service-name=<service-name>"
Cisco:Avpair="subscriber:command=bounce-host-port"
Cisco:Avpair="subscriber:command=disable-host-port"
Cisco:Avpair="subscriber:command=session-query"
Cisco:Avpair="subscriber:command=reauthenticate"
Cisco:Avpair="subscriber:reauthenticate-type=last" or
Cisco:Avpair="subscriber:reauthenticate-type=rerun"
This is a standard disconnect request and does not require a VSA.
Cisco:AVpair="interface-template-name=<interfacetemplate>"
Configuring RADIUS
OL-29048-01
Hide quick links:
Advertisement
Table of Contents
