What is COA in NAC

COA (Change of Authorization) is a mechanism defined in the RADIUS protocol (Remote Authentication Dial-In User Service) that allows a RADIUS server (typically a NAC server like Cisco ISE or Aruba ClearPass) to dynamically change a user's network access permissions after they have already been authenticated and connected.

Purpose of COA in NAC

In a NAC environment, COA is used to enforce updated policies without disconnecting the user entirely. For example:

• A user connects to the network and is granted limited access.

• Later, the NAC system detects that the user passed security posture assessment or logged in successfully.

• NAC then sends a COA request to the network device (e.g., switch, wireless controller) to update the session, granting more privileges.