* OK to use dACL for quarantine profile, but use existing ACL on ASA for the CoA allowall ACL (or a variation of allow-this-not-that-ACL). Only after the last changes done did it start sending the CoA.

* We did do packet trace on Clearpass and did not that it did NOT send any CoA message when the solution was failing. It will magically select session-id.īasically the last steps I changed before it started working was:Ĭhange device type to Cisco (from Cisco-ASA) For the Radius_CoA 'allowall'-profile you replace the now redundant line (audit session log database.) with the value from Radius:Cisco:Cisco-AVPair instead.

Don't use the special 'auth source' for Session ID, as CP fetches does that automatically now. Parts of the linked arubapedia post is wrong for 6.6. Don't try to import the services directly, as it will fail. I did test after every change, but it didn't work! Then I did something else for 20 minutes, when I came back CP was doing the Radius CoA!! *smack head* Then I can possibly write a detail of my lab excercise, as everything is still not as it should be according to OnGuard documentation. Problem is - I'm not quite sure what made it work - yet :D Will retrace my steps and back-up a few to see when things stop working again.

Cisco anyconnect vpn asa