RADIUS CoA (Change of Authorization)
acronymStands for: Dynamic Authorization Extensions to RADIUS (RFC 5176): Disconnect and Change-of-Authorization messages from the server to the NAS
The Dynamic Authorization Extensions to RADIUS of RFC 5176: Disconnect-Request and CoA-Request messages a server sends to a network access server on UDP 3799 to end a session or change its authorisation while it is running.
Base RADIUS is request-response from the network access server; once it has issued an Access-Accept the server has no way to speak until the NAS asks again. RFC 5176 (Chiba, Dommety and Eklund of Cisco, Mitton of RSA and Aboba of Microsoft, January 2008, Informational, obsoleting RFC 3576) reverses the direction. It defines six codes: 40 Disconnect-Request, 41 Disconnect-ACK, 42 Disconnect-NAK, 43 CoA-Request, 44 CoA-ACK and 45 CoA-NAK. The RFC states that "for either Disconnect-Request or CoA-Request packets UDP port 3799 is used as the destination port", and it names the roles the other way round from normal RADIUS: the Dynamic Authorization Client, which initiates, sits on the server side, and the Dynamic Authorization Server, which receives and acts, is the NAS. A Disconnect ends the session the request identifies; a CoA changes its attributes, typically the VLAN, a filter or a session timeout. A NAS that cannot apply a requested attribute answers CoA-NAK with an Error-Cause of 401 (Unsupported Attribute). CoA is the mechanism under every policy engine's quarantine, posture change and guest expiry: the device stays attached, and the port's authorisation changes under it.
RADIUS as RFC 2865 defines it has one direction of initiative. The network access server asks, the server answers, and after the Access-Accept the server is silent until the NAS has a reason to ask again, which may be hours or, on a wired port, never. Any policy decision that arrives after the session started, a device found to be infected, a guest account expiring, an administrator wanting a port moved to another VLAN, had no channel to travel on. RFC 5176, Dynamic Authorization Extensions to Remote Authentication Dial In User Service, published in January 2008 by Chiba, Dommety and Eklund of Cisco, Mitton of RSA and Aboba of Microsoft as an Informational document obsoleting RFC 3576, supplies that channel.
The extension defines six packet codes that reuse the RADIUS packet format. 40 is Disconnect-Request, answered by 41 Disconnect-ACK or 42 Disconnect-NAK; 43 is CoA-Request, Change of Authorization, answered by 44 CoA-ACK or 45 CoA-NAK. The RFC specifies the destination: "for either Disconnect-Request or CoA-Request packets UDP port 3799 is used as the destination port". Because the initiative is reversed, the RFC also reverses the names: the Dynamic Authorization Client is the party that sends the request, which is the policy server or something acting for it, and the Dynamic Authorization Server is the party that receives it and acts, which is the NAS. A packet capture on a switch therefore shows the switch answering on 3799, which surprises engineers used to seeing it only as a client on 1812 and 1813.
A request identifies the session it is about with the same attributes the session was built from, User-Name, Calling-Station-Id, Acct-Session-Id and the NAS's own identifiers, and a CoA-Request carries the attributes that are to change. The common cases are a new VLAN through the tunnel attributes, a new filter, a shortened Session-Timeout, or a request that the NAS re-authenticate the device. Where the NAS cannot honour an attribute it answers with CoA-NAK and an Error-Cause, and the RFC assigns 401, Unsupported Attribute, to the case where the NAS does not implement what was asked; other Error-Cause values distinguish a session it cannot find from a request it will not accept.
In practice CoA is the mechanism under almost every feature a network access control product advertises as dynamic. Posture assessment that quarantines a device after it has connected, guest access that expires at a set time, a security tool that asks for an endpoint to be isolated, an administrator clicking "re-authenticate" in a console: each ends in a Disconnect-Request or a CoA-Request to the switch or controller the device is on. The device stays attached and the port's authorisation changes under it, which is both the feature and the thing to test, since a NAS that silently ignores a CoA leaves the policy engine believing a quarantine happened.
Two operational facts follow. The NAS must be configured to accept dynamic authorisation from the specific servers, with the shared secret, on port 3799, and a firewall between the server and the access layer must allow the reverse direction, which the original RADIUS flows never needed. And the shared secret and MD5 protection are the same as base RADIUS, so a server that can send CoA to a switch can disconnect anyone on it; RadSec's TLS protection extends to these messages where both ends support it, and the RadSec entry describes the transport.
Also known as: coa, change of authorization, disconnect-request, packet of disconnect, pod, rfc 5176, udp 3799