Security

Hi,

ClearPass Version:  6.11.10.260785

ArubaOS Version: ML.10.16.1060

We are in the process of migrating from Cisco Switches to Aruba Switches.

We had CoA from our ClearPass working on Cisco somewhat reliably.

We have just gotten into testing CoA with the Aruba Switches for devices that have not yet been profiled and are running into a few issues.

The CoA process is triggered within ClearPass as the "RADIUS Dynamic Authorization" tab appears.

Here is what we have confirmed:

• Confirmed the ClearPass is properly receiving dot1x requests from the Aruba Switch ✅
• Ping from ClearPass Data Port to management IP of switch ✅
• Ping from management IP of switch to ClearPass Data Port ✅
• On Aruba Switch, globally enable dynamic authorization ✅
• Verify that Aruba Switch is listening on UDP port 3799 ✅
• Verify that ClearPass is sending the CoA response to the Aruba Switch ✅
• Tried both "ArubaOS Switching - Terminate Session" and "ArbuaOS Switching - Bounce Switch Port" (both result in failure for the client)

Below is the "RADIUS Dynamic Authorization" tab from the ClearPass:

The NAS-IP-Address is the unique IP of the switch. We do have Aruba APs as well, but they are in a separate subnet.

Is there any additional configuration that needs to be done to either the Aruba Switch or in ClearPass? We are clearly missing something; we are just not sure what it is.

Regards,

Todd

First of all understanding the intention for why a COA is being used should be considered. If this is for fingerprinting and profiling a device there may be other methods. Just keep in mind that your timers should offset your caching on endpoints database. If the default caching for the endpoints db is 300 seconds. I have offset timers to be 315 to ensure devices come back after the cache has cleared. 

As you state this is a 6200, you should take a look at the COA templates and see how they are paired with the device vendor. When you create a "Network -> Device"; you can pick a vendor from this list. This vendor selection is who the COA profiles are applicable for. If you are using a subnet in the "network -> device" section and there are mixed vendors. It will create an issue on how you send COA. As you can see the templates for "ArubaOS Switching" are used for the HPE product line. This would be the HPE switches that were rebranded as aruba. The CX switch line would be under the vendor name "Aruba"

There are some other methods you can use instead of COA on mixed vendor. You can use a radius timeout (radius:ietf:session-timeout), or you can use a user role with a shorter lifetime {ie. user-role profile with timeout of 315 seconds}. I use the session-timeout across the board for all vendors on wifi and wired. Its a fairly standard radius attribute. 

Another thing to keep in mind is radius accounting. I am not sure if you ever plan on sending a COA back at a later interval, although to send COA from access tracker it does require knowledge that the client is still connected to the network. If you go into access tracker and hit change status and the "Radius dynamic authorization" is grayed out. Its due to clearpass not seeing the client as still online. This can be due to radius accounting. There could be a few reasons on this subject although I am not going to elaborate at this time. 

You can also run an easy debug on the switches and then test COA. 

• debug portaccess dynautz
• debug destination buffer
• show debug buffer

you can refer to this "Authentication and CoA Configuration" section of this technote "Aruba ClearPass Wired Enforcement for CX switches – Part1"

also refer to the ClearPass configuration that is adding the CX switch as vendor = Aruba

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

Original Message:
Sent: Oct 02, 2026 09:25 AM
From: JK-90898a
Subject: ClearPass CoA on a Aruba 6200F

First of all understanding the intention for why a COA is being used should be considered. If this is for fingerprinting and profiling a device there may be other methods. Just keep in mind that your timers should offset your caching on endpoints database. If the default caching for the endpoints db is 300 seconds. I have offset timers to be 315 to ensure devices come back after the cache has cleared. 

As you state this is a 6200, you should take a look at the COA templates and see how they are paired with the device vendor. When you create a "Network -> Device"; you can pick a vendor from this list. This vendor selection is who the COA profiles are applicable for. If you are using a subnet in the "network -> device" section and there are mixed vendors. It will create an issue on how you send COA. As you can see the templates for "ArubaOS Switching" are used for the HPE product line. This would be the HPE switches that were rebranded as aruba. The CX switch line would be under the vendor name "Aruba"

There are some other methods you can use instead of COA on mixed vendor. You can use a radius timeout (radius:ietf:session-timeout), or you can use a user role with a shorter lifetime {ie. user-role profile with timeout of 315 seconds}. I use the session-timeout across the board for all vendors on wifi and wired. Its a fairly standard radius attribute. 

Another thing to keep in mind is radius accounting. I am not sure if you ever plan on sending a COA back at a later interval, although to send COA from access tracker it does require knowledge that the client is still connected to the network. If you go into access tracker and hit change status and the "Radius dynamic authorization" is grayed out. Its due to clearpass not seeing the client as still online. This can be due to radius accounting. There could be a few reasons on this subject although I am not going to elaborate at this time. 

You can also run an easy debug on the switches and then test COA. 

• debug portaccess dynautz
• debug destination buffer
• show debug buffer