Cisco Switch not accept CoA from FortiNAC

Hello Lyyiheang, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

Mac auth is not going to continue being viable much longer, if it could be said to be even viable at all now. All mobile devices sold within the last few years have the ability to use virtual mac addresses at the flip of a switch and I expect desktop operating systems will begin offering this as a standard feature as well. It's possible to do on basically any OS currently but not built in https://mobdro.bio/ .

Hello  @Lyyiheang,

checking the CoA NAK response it complains about the session identifier.

For this you can use either "User Name" or the "Calling-station-ID".

Additionally i see you are adding in the CoA message itself the Access list attributes. This is not correct. In the CoA message you need to add an action such as bouncing the port or re-authentication. Then you add the Access lists in the Radius response (Accept-Accept) once the host re-authenticates.

This article provides you with the example when FortiSwitch is acting as NAS:

https://community.fortinet.com/t5/FortiNAC-F/Technical-Tip-CoA-Support-in-FortiNAC-7-4-and-applying-DACLs-in/ta-p/322638

For FortiSwitch we use the Fortinet proprietary arrtibute 

In your case of Cisco you can try any the following:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-s/sec-usr-aaa-15-s-book/sec-rad-coa.html