RADIUS Disconnect Message and CoA Events

The following events occur when a disconnect message is sent out by the Dynamic Authorization Client (DAC):

  • A disconnect request packet is sent by the Dynamic Authorization Client (DAC) to terminate the session on the NAS (Network Access Server) and discard the associated session contexts.

  • The request identifies the NAS and the session to be removed. This packet is sent to UDP port 3799 on the NAS.

  • The NAS responds with a disconnect-ACK if the session is identified, removed, and no longer valid.

  • The NAS sends a disconnect-NAK if it is unable to disconnect the session.

The following events occur when a change of authorization request packet is sent by the Dynamic Authorization Client (DAC):

  • A change of authorization request packet is sent by the Dynamic Authorization Client (DAC) to change the session authorizations on the NAS. This is used to change the filters, such as Layer 3 ACLs.
  • The request identifies the NAS and the sessions to be authorized. The request carries the filter ID attribute (type 11). The attribute specifies the IP ACL that is to be applied. This packet is sent to UDP port 3799 on the NAS.

  • The NAS responds with a CoA-ACK (CoA acknowledgment) if the session is identified and authorized with new filters. It sends a CoA non-acknowledgment if it is unable to apply the filters on the session.
Note: RUCKUS ICX devices support applying ACLs to those sessions that have IP ACLs applied in the previous Authorization. You cannot use CoA to configure IP ACLs on a session that is not authenticated with an ACL.

Parent topic: Enabling RADIUS CoA and Disconnect Message Handling for Dynamic Authorization