Change of Authorization with RADIUS (CoA) on MR Access Points

Use Cases

Change of Authorization is used to change client authorizations in the following use cases:

 

Reauthenticate RADIUS Clients

Changing the Group Policy or VLAN for an existing client session using a WPA2-Enterprise network is possible using CoA to force the client to re-authenticate and assign the new policy. CoA Reauthentication. 

 

Disconnecting RADIUS Clients

Disconnecting an client on a WPA2-Enterprise network, CoA enables administrators and RADIUS servers to 'kick off' a client device from the network. This will often force a client to re-authenticate and assign a new policy. 

 

Cisco ISE Device Posturing

For customers that use Cisco ISE for the identity management solution, Cisco ISE can profile a client when they join the secure WPA2-Enterprise network, place the client on a quarantine VLAN. Then using CoA, Cisco ISE can inform the AP when the posturing is completed to grant elevated network access. 

 

Cisco ISE Central Web Authentication (CWA)

Customers may choose to use Cisco ISE as their guest management solution. Using MAC-based Authentication (MBA) on a open network, Cisco ISE can instruct the AP to redirect the client to the guest portal hosted on the Cisco ISE server. After the client satisfies the guest portal requirements, Cisco ISE will instruct the AP using CoA to grant elevated network access.

CoA Considerations and Requirements

 

These are the considerations and requirements that need to be made when using Change of Authorization to change client authorizations:

 

Supported Client IP assignment methods:

• NAT mode, Bridge mode, Layer 3 Roaming, Layer 3 Roaming with a Concentrator*, VPN*

 

 

Supported association requirement methods:

• MAC-based access control
• WPA2-Enterprise with RADIUS server

 

Change in CoA functionality from MR 25 to MR 26:

• MR 25 - When the server sends a CoA request, the client is completely disassociated from its existing session. The client device has to initiate a new RADIUS session
• MR 26 - When the server sends a CoA request, the client is not completely disassociated from its RADIUS session. Instead, the AP sends a new EAP request to the client to reauthenticate

Visibility of Username and account information: 

• Supported for MAC-based authentication and WPA2-Enterprise with RADIUS authentication but not with Cisco ISE Central Web Authentication (CWA)

 

Cloud RADIUS proxy:

• Cloud RADIUS proxy is not supported with CoA

Configuration

Enable Cisco ISE

For Cisco ISE servers, enable Cisco Identity Services Engine (ISE) Authentication. If enabled, Meraki devices will use the value of the RADIUS CiscoAVPair 'url-redirect' attribute sent in RADIUS Access-Accept messages to redirect clients to the Cisco ISE web portal for authentication.

Enable RADIUS CoA support 

For RADIUS servers other than Cisco ISE, enable CoA support under Wireless > Configure > Access control > RADIUS. With Cisco ISE, RADIUS CoA is automatically enabled. If enabled, Meraki devices will act as a RADIUS Dynamic Authorization Server (CoA) and will respond to RADIUS Disconnect and Change of Authorization messages sent by the RADIUS server.