CoA (Change of Authorization)

What CoA is

Change of Authorization (CoA) is a RADIUS mechanism for dynamically changing a device's live network access. It lets a RADIUS server reach back into a session that is already running and change what the device is allowed to do — or end the session entirely. The user does not have to disconnect and authenticate again.
CoA is what turns RADIUS from a one-time gate at the door into a live control over every session on the network.

The problem CoA solves

Classic RADIUS is one-directional. The network access server asks a question and the RADIUS server answers; once the device is authorized, the server has no way to influence the live session. If anything changes afterwards — a policy update, a security alert, a captive portal login finishing — the only blunt option was to wait for the session to expire and re-authenticate.
That is too slow for guest onboarding and far too slow for security response. CoA closes the gap by letting the server initiate messages to the network device mid-session.

How CoA works

A RADIUS server, or a policy engine acting through it, sends a CoA-Request to the network access server that owns the session. The network device looks up the session, applies the change, and acknowledges with CoA-ACK, or rejects it with CoA-NAK if it cannot comply. There are two main actions:

• Change of Authorization: apply new attributes to the running session — a different VLAN, a new downloadable ACL, a fresh role or a revised bandwidth limit.
• Disconnect-Message (DM): terminate the session so the device must re-authenticate before it can reconnect.

Identifying the right session

For CoA to act on the correct session, the server must identify it precisely. It does this with session attributes such as the Acct-Session-Id, the device's MAC address (Calling-Station-Id) or its framed IP address. It authenticates the request using the shared secret it holds with the network access server.
CoA messages typically travel on UDP port 3799. If the network device cannot match the session or does not trust the sender, it returns a CoA-NAK rather than applying the change.

Where CoA is used

CoA quietly powers flows that users experience as instant. On a captive portal, CoA upgrades a guest from the restricted pre-login role to full internet access the moment they finish logging in. In network access control, CoA quarantines an endpoint that fails a posture check, or revokes a device the instant it is flagged as compromised.
It also supports everyday operations such as moving a device to a new VLAN when its role changes, or cutting off a session when an account is disabled.

CoA and security response

Speed is the whole point of CoA in a security context. When a threat is detected, waiting minutes for a session to expire can be the difference between containment and a spreading incident. CoA lets a NAC or SIEM-driven workflow disconnect or isolate a device in seconds, network-wide.
Cloud4Wi uses CoA so that policy changes and security responses take effect immediately across distributed sites, rather than waiting for the next