Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In

Dell EMC Configuration Guide for the S3100 Series 9.14.2.4

PDF

Configuring CoA to re-authenticate 802.1x sessions

Dell EMC Networking OS provides RADIUS extension commands that enables you to configure re-authentication of 802.1x user sessions. When you configure this feature, the DAC sends the CoA request to re-authenticate the 802.1x uer session when ever the authorization level of the user’s profile changes.

Before configuring re-authentication of 802.1x sessions, ensure that the following prerequisites are satisfied:
  • Shared key is configured in NAS for DAC.
  • NAS server listens on the Management IP UDP port 3799 (default) or the port configured through CLI.
  • The user is logged-in through 802.1X enabled physical port and successfully authenticated with Radius Server.
To initiate 802.1x session re-authentication, the DAC sends a standard CoA request that contains one or more session identification attributes. NAS uses the calling-station-id or the NAS-port attributes to identify a 802.1x user session. In case of the EAP or MAB users, the MAC address is the calling-station-id of the supplicant and the NAS-port is the interface identifier. If both these attributes are present in the CoA request, NAS retrieves the supplicant connected to the interface. The EAP or MAB user sessions are re-authenticated and the NAS sends a CoA-Ack to the user, in case the re-authentication is successful.
  1. Enter the following command to configure the dynamic authorization feature:
    radius dynamic-auth
  2. Enter the following command to configure the re-authentication of 802.1x sessions:
    coa-reauthenticate
    NAS re-initiates the user authentication state.
Dell(conf#)radius dynamic-auth
Dell(conf-dynamic-auth#)coa-reauthenticate
NAS takes the following actions whenever re-authentication is triggered:
  • validates the CoA request and the session identification attributes.
  • sends a CoA-Nak with an error-cause of 402 (missing attribute), if the CoA request does not contain both the calling-station-id as well as the NAS-port attribute.
  • sends a CoA-Ack if the re-authentication of the 802.1x session is successful.
  • sends a CoA-Nak with an error-cause value of 506 (resource unavailable), if it is unable to initiate the re-authentication process.
  • sends a CoA-Nak if user authentication fails due to unresponsive supplicant or RADIUS server.
  • sends a CoA-Ack, if the user is configured with static MAB profile.
  • discards the packet, if simultaneous requests are received for the same calling-station-id or NAS-port or both.
  • returns an error-cause value of 503 (session context not found), if it is not able to retrieve the session using the calling-station-id or NAS-port attribute or both.
  • sends NAK if user is configured with forced-unauthorization.
  • sends-ACK if user is configured with forced-authorization.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\