Could anyone explain Radius COA in layman language? I know only one feature where the radius assigns the VLAN. Appreciate your time on this.
2
-
does this help? RADIUS COA– Craig ConstantineCommented Jul 20, 2015 at 15:05
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Commented Aug 12, 2017 at 3:32
Add a comment
|
1 Answer
Originally with RADIUS AAA a client would authenticate and be granted access/authority via a policy. However if during this session the endpoints were to experience some changes that affected authorization there was no way to reauthenticate/re-apply policy/change policy without disconnection.
The outcome ended up being that a client would be disconnected and then have to reconnect to receive an altered AAA policy/profile.
Thus with CoA, changes can be made to authorization within a current AAA session. Using your vlan example - a client could authenticate and be placed in a walled garden VLAN, once NAC or some other system determines the device to be clean then a CoA can be sent to the network device which triggers a VLAN change for the client to an unrestricted VLAN.
I was largely exposed to CoA at my previous job for an ISP. CoA was used to trigger shaping QoS policies in-flight for users that had breached their download quota limit. This meant no disconnections for users just to apply a new QoS policy to their virtual interface.
HTH.
