Cisco's default port for RADIUS Change of Authorization — how a NAC server re-authorizes or bounces a live session.
IANA registers 1700 as "mps-raft" on both TCP and UDP, and nothing uses that registration. What actually lives here is RADIUS CoA: RFC 5176 standardized UDP 3799 for Change-of-Authorization and Disconnect-Message packets, but Cisco shipped 1700 first and kept it, so Cisco switches, WLCs, and Cisco ISE default their CoA listener to UDP 1700. Seeing it open means a network access device that a NAC/802.1X server can push policy changes to mid-session — change the VLAN, apply a new ACL, or kick the client off.
Do not expose
A CoA listener acts on packets authenticated only by a shared RADIUS secret; anyone who can reach it and learn or guess that secret can disconnect users or move them into a privileged VLAN — restrict it to the RADIUS/ISE servers by ACL.
$ nmap -sU -p 1700 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.