OK, so I did not have the "Add switch IP address in the redirection URL" - so that is ticked - I see the logic there, and I should have had that on, I have a multicontroller environment,
However no difference is seen. same error on CPPM "failed to connect to ACS device"
On the other hand I did take a pcap - useful tip there arjan thanks - and I do see the CoA packet come in - 6 in fact and 2 reporting to be duplicates. Presumaly "3 tries and your out" kind of attempts. I see the right MAC address in the packet too - but is is represented in upper case with no delimeters between octects in the mac address.
I did see the CoA call in with a datapath session table command before, but not to this detail - it is reassuring the mac is right in the packet payload as well the source and destination.
Thank you both for your help - is there any way to determine - out of sheer paranoia that the psks in the rfc3576 is ok?
I can't help thinking I have misssed something basic here. I have used amigopod before but never had this problem.