What is the most likely cause of wired guest disconnect CoA not being applied when ClearPass reports a disconnect, given the following configuration and behavior?

What is the most likely cause of wired guest disconnect CoA not being applied when ClearPass reports a disconnect, given the following configuration and behavior?

• A. Change of Authorization has not been globally enabled on the switch
• B. The SSL certificate for CPPM has not been added as a trust point on the switch
• C. There is a mismatch between the RADIUS secret on the switch and CPPM
• D. There is a time difference between the switch and the ClearPass Policy Manager

Answer: (D)

Time synchronization between the switch and the ClearPass server is essential when using Change of Authorization to disconnect a wired guest session. Disconnect requests are validated by the NAS (the switch) and may rely on time-based checks, such as validating the freshness of the message or the TLS certificate’s validity window if RADIUS is secured (RADSEC). If the switch’s clock is significantly different from ClearPass, the Disconnect-Request can be treated as stale or invalid, and the switch will not apply the CoA to terminate the session. That’s why a time difference between the switch and ClearPass is the most likely cause. If CoA were not globally enabled, or the ClearPass certificate isn’t trusted, or the RADIUS secret mismatches, you’d typically see a broader failure (CoA not functioning at all or authentication failure) rather than a disconnect being reported but not applied. The timing mismatch specifically explains why a disconnect is issued but not enacted. To fix it, ensure accurate time via NTP on both devices and verify any RADSEC/TLS certificate validity windows.

Time synchronization between the switch and the ClearPass server is essential when using Change of Authorization to disconnect a wired guest session. Disconnect requests are validated by the NAS (the switch) and may rely on time-based checks, such as validating the freshness of the message or the TLS certificate’s validity window if RADIUS is secured (RADSEC). If the switch’s clock is significantly different from ClearPass, the Disconnect-Request can be treated as stale or invalid, and the switch will not apply the CoA to terminate the session. That’s why a time difference between the switch and ClearPass is the most likely cause.

If CoA were not globally enabled, or the ClearPass certificate isn’t trusted, or the RADIUS secret mismatches, you’d typically see a broader failure (CoA not functioning at all or authentication failure) rather than a disconnect being reported but not applied. The timing mismatch specifically explains why a disconnect is issued but not enacted. To fix it, ensure accurate time via NTP on both devices and verify any RADSEC/TLS certificate validity windows.