# WHATPORT(1700)

## NAME

port 1700 — RADIUS Change of Authorization (Cisco default) — Cisco's default port for RADIUS Change of Authorization — how a NAC server re-authorizes or bounces a live session.

Protocol: UDP  
IANA registry

## DESCRIPTION

IANA registers 1700 as "mps-raft" on both TCP and UDP, and nothing uses that registration. What actually lives here is RADIUS CoA: RFC 5176 standardized UDP 3799 for Change-of-Authorization and Disconnect-Message packets, but Cisco shipped 1700 first and kept it, so Cisco switches, WLCs, and Cisco ISE default their CoA listener to UDP 1700. Seeing it open means a network access device that a NAC/802.1X server can push policy changes to mid-session — change the VLAN, apply a new ACL, or kick the client off.

## EXPOSURE

**Do not expose.** A CoA listener acts on packets authenticated only by a shared RADIUS secret; anyone who can reach it and learn or guess that secret can disconnect users or move them into a privileged VLAN — restrict it to the RADIUS/ISE servers by ACL.

## CHECK

```sh
nmap -sU -p 1700 TARGET
```

## SEE ALSO

- docs — [Cisco Catalyst 1300 CLI Guide — RADIUS Change of Authorization (default UDP port 1700)](https://www.cisco.com/c/en/us/td/docs/switches/campus-lan-switches-access/Catalyst-1200-and-1300-Switches/cli/C1300-cli/radius-change-of-authorization.html) (cisco.com)
- spec — [RFC 5176 — Dynamic Authorization Extensions to RADIUS (standard port 3799)](https://www.rfc-editor.org/rfc/rfc5176.html) (rfc-editor.org)
- iana — [IANA port registry — 1700 (registered as mps-raft)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1700) (iana.org)

---

HTML: <https://whatport.net/1700/> · JSON: <https://whatport.net/1700.json> · full dataset: <https://whatport.net/ports.json>