- [Instructor] RADIUS change of authorization
or CoA is a feature that allows a RADIUS server
to adjust an active client session.
For instance, ISE can issue a CoA RADIUS attribute
to an access device to force the session
to be reauthenticated.
An example is the use
of CoA when the Threat Centric Network Access Control
or TC-NAC detects a vulnerability.
The TC-NAC is a feature that enables ISE to collect threat
and vulnerability data
from many third party threatened vulnerability
scanners and software.
The purpose of this feature is to allow ISE to have a threat
and risk view into the host
it is controlling access rights for.
Note that the TC-NAC feature enables you to have visibility
into any vulnerable hosts on the network
and to take dynamic network
quarantine actions when required.
ISE can create authorization policies based
on vulnerability attributes,
such as the Common Vulnerability Scoring System
or CVSS scores which are received
from your third party threat
and vulnerability assessment software.
Threat severity levels
and vulnerability assessment results can be used
to dynamically control the access level
of an endpoint or a user.
When a vulnerability event is received for an endpoint
Cisco ISE can then automatically trigger a change
of authority for that endpoint
as demonstrated in the diagram below.