Cisco ISE CoA Not Working: Switch AAA When VLAN Never Changes After Posture

Cisco ISE · Techclick CLI troubleshooting lab

Posture goes compliant. VLAN never changes. User stays in the quarantine VLAN until they unplug.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

ISE sent (or failed to send) a Change of Authorization. The switch must allow CoA from ISE and bounce the session.

Why this ticket shows up

Without CoA, authorization is whatever the first session was. Posture success is meaningless on the wire.

Symptoms operators actually see

• Posture compliant, VLAN old

• No CoA in switch log

• ISE CoA port 1700/3799 blocked

• NAD missing CoA secret

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show authentication sessions interface Gi1/0/20 details
show logging | include COA|Dynamic
show running-config | include radius|coa|dynamic
test aaa group radius ISE_GROUP user pass new-code

How to read that output

The session must show the new VLAN after CoA. If ISE logs CoA success and the switch never logs it, the packet was filtered.

Triage order

1. Watch ISE for CoA sent

2. On the switch, confirm dynamic authorization

3. Allow UDP 1700/3799 from ISE

4. Manually reauth the port once

5. Retest posture

Classic traps

What you see	Real cause	Fix
Tell the user to reboot	CoA should have bounced them	Fix CoA
Disable posture	VLAN change is the design	Fix NAD CoA
Change the first AuthZ VLAN	You will still be stuck without CoA	Both are needed

Proof the ticket is closed

• Switch log shows CoA

• Session VLAN updates

• User reaches production without unplugging

Say this in an interview

Posture without CoA is a report, not a control. I prove the switch accepted CoA.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/