Cisco Systems IE3010 Overview, Change-of-Authorization Requests

9-21

Cisco IE 3010 Switch Software Configuration Guide

OL-23145-01

Chapter 9 Configuring Switch-Based Authentication

Controlling Switch Access with RADIUS

• CoA Request Commands, page 9-24

• Session Reauthentication, page 9-25

Overview

A standard RADIUS interface is typically used in a pulled model where the request originates from a

network attached device and the response come from the queried servers. Catalyst switches support the

RADIUS Change of Authorization (CoA) extensions defined in R FC 5176 that are typically used in a

pushed model and allow for the dynamic reconfiguring of sessions from external authentication ,

authorization, and accounting (AAA) or policy servers.

Beginning with Cisco IOS Release 12.2(52)SE, the switch supports these p er-session CoA requests:

• Session reauthentication

• Session termination

• Session termination with port shutdown

• Session termination with port bounce

This feature is integrated with the Cisco Secure Access Control Server (ACS) 5.1. For information about

ACS:

http://www.cisco.com/en/US/products/ps9911/tsd_products_support_series_home.html

The RADIUS interface is enabled by default on Catalyst switches. However, some basic configuration

is required for these attributes:

• Security and Password—See the “Preventing Unauthorized Access to Your Switch” section in the

“Configuring Switch-Based Authentication” chapter in the Catalyst 3750 Switch Software

Configuration Guide, Cisco Release 12.2(50)SE.

• Accounting—See the “Starting RADIUS Accounting” section in the “Configuring Switch-Based

Authentication” chapter in the Catalyst 3750 Switch Software Configuration Guide, 12.2(50)SE.

Change-of-Authorization Requests

Change of Authorization (CoA) requests, as described in RFC 5176, are used in a push model to allow

for session identification, host reauthentication, and session termination . The model is comprised of one

request (CoA-Request) and two possible response codes:

• CoA acknowledgement (ACK) [CoA-ACK]

• CoA non-acknowledgement (NAK) [CoA-NAK]

The request is initiated from a CoA client (typically a RADIUS or policy server) and directed to the

switch that acts as a listener.

This section includes these to pics:

• CoA Request Response Code

• CoA Request Commands

• Session Reauthentication

The Disconnect Request message, which is also referred to as Packet of Disconnect (POD), is supp orted

by the switch for session termination.