Change of Authorization

dsource d000 dev/network
ISE_MNT="${ISE_MNT_IP:-$ISE_PAN_IP}"
ISE_AUTH="${ISE_API_USER}:${ISE_API_PASS}"
BASE_URL="https://${ISE_MNT}/admin/API/mnt"

netapi ise mnt coa --mac "C8:5B:76:C6:59:62" --action reauth

# Reauthenticate session by MAC
MAC="C8:5B:76:C6:59:62"

# First get NAS IP from session
NAS_IP=$(curl -sk -u "${ISE_AUTH}" \
  "${BASE_URL}/Session/MACAddress/${MAC}" \
  -H "Accept: application/xml" | \
  grep -oP '(?<=<nas_ip_address>)[^<]+')

# Send CoA Reauth
curl -sk -u "${ISE_AUTH}" \
  "${BASE_URL}/CoA/Reauth/${NAS_IP}/${MAC}/1" \
  -H "Accept: application/xml" \
  -X PUT

netapi ise mnt coa --mac "C8:5B:76:C6:59:62" --action disconnect

# Disconnect session by MAC (port bounce)
MAC="C8:5B:76:C6:59:62"

NAS_IP=$(curl -sk -u "${ISE_AUTH}" \
  "${BASE_URL}/Session/MACAddress/${MAC}" \
  -H "Accept: application/xml" | \
  grep -oP '(?<=<nas_ip_address>)[^<]+')

curl -sk -u "${ISE_AUTH}" \
  "${BASE_URL}/CoA/Disconnect/${NAS_IP}/${MAC}/1" \
  -H "Accept: application/xml" \
  -X PUT

# Reauthenticate by endpoint IP
ENDPOINT_IP="10.50.10.100"

# Get session details
SESSION=$(curl -sk -u "${ISE_AUTH}" \
  "${BASE_URL}/Session/EndPointIPAddress/${ENDPOINT_IP}" \
  -H "Accept: application/xml")

MAC=$(echo "$SESSION" | grep -oP '(?<=<calling_station_id>)[^<]+')
NAS_IP=$(echo "$SESSION" | grep -oP '(?<=<nas_ip_address>)[^<]+')

curl -sk -u "${ISE_AUTH}" \
  "${BASE_URL}/CoA/Reauth/${NAS_IP}/${MAC}/1" \
  -H "Accept: application/xml" \
  -X PUT

#!/bin/bash
# reauth-policy-change.sh
# Reauthenticate endpoints affected by policy change

POLICY_SET="Wired_802.1X_Closed"

echo "Finding active sessions using policy: ${POLICY_SET}"

# Get sessions using this policy (requires DataConnect)
MACS=$(netapi ise dc --format json query "
  SELECT DISTINCT CALLING_STATION_ID
  FROM RADIUS_AUTHENTICATIONS
  WHERE POLICY_SET_NAME = '${POLICY_SET}'
  AND TIMESTAMP_TIMEZONE > SYSDATE - 1/24
"  | tail -n +2)

COUNT=$(echo "$MACS" | wc -l)
echo "Found ${COUNT} endpoints"

read -p "Reauthenticate all? (y/n) " -n 1 -r
echo

if [[ $REPLY =~ ^[Yy]$ ]]; then
  echo "$MACS" | while read MAC; do
    echo "Reauth: ${MAC}"
    netapi ise mnt coa --mac "${MAC}" --action reauth
    sleep 0.5
  done
fi

# CoA with verification
MAC="C8:5B:76:C6:59:62"

echo "=== Before CoA ==="
netapi ise mnt session "${MAC}"

echo -e "\n=== Sending Reauth ==="
netapi ise mnt coa --mac "${MAC}" --action reauth

echo -e "\n=== Waiting for reauth... ==="
sleep 5

echo -e "\n=== After CoA ==="
netapi ise mnt session "${MAC}"

#!/bin/bash
# scheduled-reauth.sh
# Reauthenticate specific endpoints (for cron jobs)

MACS=(
  "C8:5B:76:C6:59:62"
  "98:BB:1E:1F:A7:13"
  "14:F6:D8:7B:31:80"
)

LOGFILE="/var/log/ise-coa-$(date +%Y%m%d).log"

dsource d000 dev/network

for MAC in "${MACS[@]}"; do
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] Reauth: ${MAC}" >> "$LOGFILE"

  RESULT=$(netapi ise mnt coa --mac "${MAC}" --action reauth 2>&1)

  if [ $? -eq 0 ]; then
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] Success: ${MAC}" >> "$LOGFILE"
  else
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] Failed: ${MAC} - ${RESULT}" >> "$LOGFILE"
  fi

  sleep 1
done

# CoA Response Interpretation

Success responses:
- "true" or empty response = CoA sent successfully
- Note: "Success" means ISE sent CoA, not that device acknowledged

Common failures:
- "No active session found" = Endpoint not authenticated
- "CoA failed" = NAS rejected or timed out
- "Invalid MAC format" = Use XX:XX:XX:XX:XX:XX

Troubleshooting:
1. Verify session exists: netapi ise mnt session "MAC"
2. Check NAS supports CoA (RFC 5176)
3. Check ISE-to-NAS connectivity on port 1700/3799
4. Verify NAS has matching RADIUS shared secret

# Monitor CoA results in ISE logs (via DataConnect)
netapi ise dc --format json query "
  SELECT
    TO_CHAR(TIMESTAMP_TIMEZONE, 'HH24:MI:SS') as time,
    CALLING_STATION_ID as mac,
    NAS_IP_ADDRESS as nas,
    MESSAGE_CODE,
    PASSED
  FROM RADIUS_ACCOUNTING
  WHERE MESSAGE_CODE IN ('COA-ACK', 'COA-NAK', 'Disconnect-ACK', 'Disconnect-NAK')
  AND TIMESTAMP_TIMEZONE > SYSDATE - 1/24
  ORDER BY TIMESTAMP_TIMEZONE DESC
  FETCH FIRST 20 ROWS ONLY
"