Question

An administrator has configured the ISE Profiler with the global CoA type set to 'No CoA'. During testing, an endpoint that initially matched a generic profile is later re-profiled as a corporate workstation after additional DHCP attributes are collected. The authorization policy grants different access based on the new profile. However, the endpoint retains its original, less-privileged access even after re-profiling completes. What is the reason for this behavior?

Accepted Answer

With the global CoA type set to 'No CoA', ISE updates the endpoint profile but does not issue a Change of Authorization, so the session keeps its original authorization until it reauthenticates naturally.

Answer

The DHCP probe cannot trigger re-profiling once a session is already authorized, so the new attributes are ignored.

Answer

The endpoint must be manually added to a static endpoint identity group before any authorization change can occur.

Answer

A 'No CoA' setting disables endpoint attribute collection entirely, so the profile change never actually happened.