An engineer is migrating users from MAB to 802.1X on the network. This must be done during normal business hours with minimal impact to users. Which CoA method should be used?

Session Reauthentication is the most suitable Change of Authorization (CoA) method for migrating users from MAB to 802.1X with minimal impact. This method, also known as CoA Reauth, instructs the network access device (e.g., switch) to initiate a new authentication with the endpoint without terminating the existing session or causing the physical port to go down and up (link flap). The endpoint's supplicant can then respond to the new EAP request, completing the 802.1X authentication seamlessly. This process avoids the disruption to user applications and DHCP lease renewals that would be caused by a port bounce.

A. Port Bounce causes a link-state change (down/up), which is disruptive to the user's session and applications.
B. Port Shutdown completely disconnects the user from the network, causing maximum impact and requiring manual intervention to restore.
C. Session Termination is more disruptive than reauthentication as it tears down the entire session, forcing a complete reconnection.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Change of Authorization on Cisco ISE" section: This guide defines the CoA types. It states for Re-authentication: "Forces the user device to reauthenticate. The existing session is not terminated." For Port Bounce

it notes: "Forces the port to go down and then come up. This is useful for endpoints that do not support reauthentication..." This directly supports using reauthentication for a less disruptive experience.

2. Cisco Identity Services Engine (ISE) High Level Design (HLD) Guide

"Phased Deployment" section: In migration scenarios

this guide outlines the strategy of starting with MAB and then transitioning to 802.1X. The transition is typically triggered by a CoA Reauth after a supplicant is provisioned or enabled

specifically to avoid disrupting the end-user.

3. Cisco Live Presentation BRKSEC-3699 (2019)

"Advanced ISE Services

Tips and Tricks"

Slide 45

"CoA Types": This presentation details the different CoA types and their use cases. It explicitly contrasts "CoA Reauth" (no link flap) with "CoA Terminate/Port-Bounce" (link flap)

recommending Reauth for scenarios like supplicant provisioning where minimal user impact is desired.