This is off the cuff, but in the past I’ve had issues with Cisco WLCs taking CoAs when the Event-Timestamp attribute was present.
thx, felix From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]> on behalf of "Turner, Ryan H" <[email protected]> Reply-To: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]> Date: Friday, April 17, 2020 at 9:26 AM To: "[email protected]" <[email protected]> Subject: [WIRELESS-LAN] Advanced NAC question regarding RFC3587 (Change of Authorization) We currently use Extreme Network Access Control. We have had this for 14 years and it works very well. We integrated it with Aruba wireless years ago, and we are able to send back filter IDs on the initial authentication to change roles, as well as issue disconnects to the user, forcing them to reauthenticate to their new policy (for example, a user is online and doing something bad, we send a disconnect message to the controllers and the user reconnects and authenticates with the new role). We are now having to integrate with another institutions Cisco wireless controllers. We have the authentication stuff working great. But we are unable to get the disconnect/CoA to work. We believe we have the correct format (xx-xx-xx-xx-xx-xx) and we are utilizing the correct port for 3587 (I think it is UDP 3799 off the top of my head). We are getting back NAKs, and the message indicated is ‘invalid attributes’. We aren’t sure what attributes to send back for the disconnect. Obviously the other third party NACs have to do this correctly, but I’ve been unable to find documentation. Extreme has some old documentation, but it appears wrong. Any experts out there on this? Anyone willing to do a reauthentication from their NAC to their controllers and send us the packet trace? If we know what attributes you are sending, that is likely what we need to make this work. I’ve opened a ticket to Extreme, and I’ve asked the other institution to open a ticket with Cisco. But this may get me results quicker. Thanks! Ryan Turner Head of Networking Communication Technologies | Information Technology Services [email protected]<mailto:[email protected]> +1 919 445 0113 (Office) +1 919 274 7926 (Mobile) ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C01%7Cfelix.windt%40DARTMOUTH.EDU%7Cc9e908903f6e46cf822108d7e2d2f0fb%7C995b093648d640e5a31ebf689ec9446f%7C0%7C0%7C637227267926747319&sdata=WnCm87U42oIY9FHU8F3T0OteowYT3ihSRQQd9h92%2F5Y%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
