To force a session to be adjusted after a policy change is made, two configurations are required on Cisco ISE and on Cisco TrustSec devices: Dynamic Authorization and Change of Authorization (CoA). Dynamic Authorization allows Cisco ISE to send commands to network devices to change the authorization status of a user session. CoA is a feature that enables Cisco ISE to send a RADIUS message to a network device to reauthenticate or disconnect a user session. These two configurations enable Cisco ISE to apply the updated policy to the user session without requiring the user to log out and log in again.
According to the source book, the steps to configure Dynamic Authorization and CoA are as follows1:
On Cisco ISE, navigate to Administration > Network Resources > Network Devices and select the network device that supports TrustSec.
On the Edit Network Device page, select the Advanced TrustSec Settings tab and check the Support for CoA check box.
On the same tab, select the appropriate CoA type from the drop-down list. The options are RADIUS Disconnect, Port Bounce, and Reauth.
Click Submit to save the changes.
On the network device, enter the global configuration mode and issue the command aaa server radius dynamic-author to enable Dynamic Authorization.
Optionally, you can specify the source interface, authentication key, and port number for the Dynamic Authorization messages.
Exit the global configuration mode and save the configuration.
1: Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 4: Secure Connectivity, Lesson 4.2: Implementing TrustSec, Topic 4.2.3: Configuring TrustSec on Cisco ISE and Network Devices, pp. 4-83 to 4-85.
Submit