{
  "port": 1700,
  "protocol": "udp",
  "service": "RADIUS Change of Authorization (Cisco default)",
  "oneLiner": "Cisco's default port for RADIUS Change of Authorization — how a NAC server re-authorizes or bounces a live session.",
  "whatItIs": "IANA registers 1700 as \"mps-raft\" on both TCP and UDP, and nothing uses that registration. What actually lives here is RADIUS CoA: RFC 5176 standardized UDP 3799 for Change-of-Authorization and Disconnect-Message packets, but Cisco shipped 1700 first and kept it, so Cisco switches, WLCs, and Cisco ISE default their CoA listener to UDP 1700. Seeing it open means a network access device that a NAC/802.1X server can push policy changes to mid-session — change the VLAN, apply a new ACL, or kick the client off.",
  "exposure": {
    "verdict": "never",
    "note": "A CoA listener acts on packets authenticated only by a shared RADIUS secret; anyone who can reach it and learn or guess that secret can disconnect users or move them into a privileged VLAN — restrict it to the RADIUS/ISE servers by ACL."
  },
  "checkCommand": "nmap -sU -p 1700 TARGET",
  "links": [
    {
      "title": "Cisco Catalyst 1300 CLI Guide — RADIUS Change of Authorization (default UDP port 1700)",
      "url": "https://www.cisco.com/c/en/us/td/docs/switches/campus-lan-switches-access/Catalyst-1200-and-1300-Switches/cli/C1300-cli/radius-change-of-authorization.html",
      "kind": "official-docs"
    },
    {
      "title": "RFC 5176 — Dynamic Authorization Extensions to RADIUS (standard port 3799)",
      "url": "https://www.rfc-editor.org/rfc/rfc5176.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1700 (registered as mps-raft)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1700",
      "kind": "iana"
    }
  ]
}